gsadmin/unleash
1
0
Fork 0
mirror of https://github.com/Unleash/unleash.git synced 2026-11-02 17:05:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
16,624 Commits 745 Branches 921 Tags
dependabot/github_actions/actions/setup-node-7
Commit Graph

2461 Commits

Author SHA1 Message Date
Christopher Kolstad de76f2aded chore: security maintenance 
This won't fix all warnings, but it should get undici and nodemailer out
of our way.

We'll need to have a look at our mcp server as well as our swagger
dependencies afterwards.
 2026-10-06 13:45:40 +02:00
renovate[bot] e35c1248b5 chore(deps): update dependency fast-check to v4.10.2 (#12706) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-check](https://fast-check.dev/)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check))
| [`4.9.0` →
`4.10.2`](https://renovatebot.com/diffs/npm/fast-check/4.9.0/4.10.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fast-check/4.10.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-check/4.9.0/4.10.2?slim=true)
|

---

### Release Notes

<details>
<summary>dubzzz/fast-check (fast-check)</summary>

###
[`v4.10.2`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4102)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.1...v4.10.2)

*Fix interrupt plugin (throwing)*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.2)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.1...v4.10.2)]

#### Fixes

- ([PR#7333](https://redirect.github.com/dubzzz/fast-check/pull/7333))
Bug: Plugin `interruptAfterTimeLimit` crashes

###
[`v4.10.1`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4101)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.0...v4.10.1)

*Fix fake-timer compatibility in timeout and interrupt plugins*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.1)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.10.0...v4.10.1)]

#### Fixes

- ([PR#7293](https://redirect.github.com/dubzzz/fast-check/pull/7293))
Bug: Capture timers for `interruptAfterTimeLimit` plugin
- ([PR#7282](https://redirect.github.com/dubzzz/fast-check/pull/7282))
CI: Temporarily disable documentation updates until v5
- ([PR#7279](https://redirect.github.com/dubzzz/fast-check/pull/7279))
Doc: Release note for 4.10.0

###
[`v4.10.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#4100)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.9.0...v4.10.0)

*New plugin API and deprecations ahead of v5*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.10.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.9.0...v4.10.0)]

#### Features

- ([PR#7216](https://redirect.github.com/dubzzz/fast-check/pull/7216))
Introduce a plugin API
- ([PR#7221](https://redirect.github.com/dubzzz/fast-check/pull/7221))
Refine plugin API
- ([PR#7222](https://redirect.github.com/dubzzz/fast-check/pull/7222))
Add ability to configure plugins globally
- ([PR#7224](https://redirect.github.com/dubzzz/fast-check/pull/7224))
Add the `beforeEach` plugin to hook in life-cycle
- ([PR#7227](https://redirect.github.com/dubzzz/fast-check/pull/7227))
Create an `afterEach` plugin
- ([PR#7232](https://redirect.github.com/dubzzz/fast-check/pull/7232))
Deprecate life-cycle methods
- ([PR#7235](https://redirect.github.com/dubzzz/fast-check/pull/7235))
Support teardown of `beforeEach` plugin
- ([PR#7228](https://redirect.github.com/dubzzz/fast-check/pull/7228))
Add `timeout` plugin to stop long running predicates
- ([PR#7237](https://redirect.github.com/dubzzz/fast-check/pull/7237))
Deprecate timeout from parameters
- ([PR#7238](https://redirect.github.com/dubzzz/fast-check/pull/7238))
Pass a store to plugins
- ([PR#7239](https://redirect.github.com/dubzzz/fast-check/pull/7239))
Add extra plugin's method called `onAllRunsComplete`
- ([PR#7240](https://redirect.github.com/dubzzz/fast-check/pull/7240))
Deprecate `reporter` and `asyncReporter` from parameters
- ([PR#7229](https://redirect.github.com/dubzzz/fast-check/pull/7229))
Add plugin to interrupt after time limit
- ([PR#7245](https://redirect.github.com/dubzzz/fast-check/pull/7245))
Support `failOnInterrupt` on the plugin
- ([PR#7230](https://redirect.github.com/dubzzz/fast-check/pull/7230))
Add plugins to drop runs on already covered cases
- ([PR#7259](https://redirect.github.com/dubzzz/fast-check/pull/7259))
Add ability to decorate `generate` via Plugins
- ([PR#7231](https://redirect.github.com/dubzzz/fast-check/pull/7231))
Add the `unbiased` plugin to generate without bias
- ([PR#7260](https://redirect.github.com/dubzzz/fast-check/pull/7260))
Deprecate parameters superseded by plugins
- ([PR#7261](https://redirect.github.com/dubzzz/fast-check/pull/7261))
Deprecate v5 removals

#### Fixes

- ([PR#7225](https://redirect.github.com/dubzzz/fast-check/pull/7225))
Bug: Proper ordering between plugins
- ([PR#7127](https://redirect.github.com/dubzzz/fast-check/pull/7127))
CI: Announce on Bluesky when drafting the release
- ([PR#7217](https://redirect.github.com/dubzzz/fast-check/pull/7217))
CI: Dedupe packages for pnpm
- ([PR#7137](https://redirect.github.com/dubzzz/fast-check/pull/7137))
Doc: Release note for 4.9.0
- ([PR#7226](https://redirect.github.com/dubzzz/fast-check/pull/7226))
Doc: Fix admonition titles on the website
- ([PR#7246](https://redirect.github.com/dubzzz/fast-check/pull/7246))
Doc: Add jkomyno as code contributor
- ([PR#7251](https://redirect.github.com/dubzzz/fast-check/pull/7251))
Performance: Single timer for `interruptAfterTimeLimit`

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-04 22:09:41 +00:00
renovate[bot] e6344c93b1 chore(deps): update dependency @fast-check/vitest to ^0.5.0 (#12703) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@fast-check/vitest](https://redirect.github.com/dubzzz/fast-check/tree/main/packages/vitest#readme)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/vitest))
| [`^0.4.1` →
`^0.5.0`](https://renovatebot.com/diffs/npm/@fast-check%2fvitest/0.4.1/0.5.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@fast-check%2fvitest/0.5.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@fast-check%2fvitest/0.4.1/0.5.0?slim=true)
|

---

### Release Notes

<details>
<summary>dubzzz/fast-check (@&#8203;fast-check/vitest)</summary>

###
[`v0.5.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/vitest/CHANGELOG.md#050)

*Support for plugins and for Vitest v5*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/vitest%2Fv0.5.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/vitest%2Fv0.4.1...vitest%2Fv0.5.0)]

#### Features

- ([PR#7219](https://redirect.github.com/dubzzz/fast-check/pull/7219))
Support plugin API of fast-check
- ([PR#7244](https://redirect.github.com/dubzzz/fast-check/pull/7244))
Support Vitest 5

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-02 20:42:27 +00:00
renovate[bot] 0a7c1c73db fix(deps): update dependency ip-address to v10.7.2 (#12702) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) |
[`10.7.1` →
`10.7.2`](https://renovatebot.com/diffs/npm/ip-address/10.7.1/10.7.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ip-address/10.7.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ip-address/10.7.1/10.7.2?slim=true)
|

---

### Release Notes

<details>
<summary>beaugunderson/ip-address (ip-address)</summary>

###
[`v10.7.2`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.7.2)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.7.1...v10.7.2)

#### What's Changed

- Accept an arpa suffix in any case and without the root dot in fromArpa
by [@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;227](https://redirect.github.com/beaugunderson/ip-address/pull/227)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.7.1...v10.7.2>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMjUuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjEyNS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-10-02 17:11:16 +00:00
renovate[bot] 4fc6b613cb fix(deps): update dependency ip-address to v10.7.1 [security] (#12694) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) |
[`10.5.1` →
`10.7.1`](https://renovatebot.com/diffs/npm/ip-address/10.5.1/10.7.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ip-address/10.7.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ip-address/10.5.1/10.7.1?slim=true)
|

---

### ip-address: Address6 builds a parse diagnostic proportional to the
input with no length bound, allowing a single long string to stall or
crash the process
[CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911) /
[GHSA-h3mg-xc3c-68pw](https://redirect.github.com/advisories/GHSA-h3mg-xc3c-68pw)

<details>
<summary>More information</summary>

#### Details
##### Summary

`new Address6()` and `Address6.isValid()` place no bound on the length
of the string they parse. When the string contains a character that
cannot appear in an IPv6 address, the parser builds a diagnostic that
wraps every such character in a 34-byte `<span class="parse-error">`, so
the work and the memory scale with the input rather than with an
address. A 1 MiB string of `!` costs about 110 MB and 70 ms of
synchronous work, 8 MiB costs about 800 MB and half a second, 16 MiB
throws a `RangeError` in place of the documented `AddressError`, and 32
MiB aborts the Node process. `isValid()` builds the diagnostic and
discards it, so a caller that only asks whether a string is valid pays
the full price.

An application that validates an attacker-supplied string with these
methods can be stalled or crashed by a single oversized request. This is
a crash on input that should have been rejected cleanly, which
SECURITY.md lists as in scope.

##### Details

`parse()` in `src/ipv6.ts` checks for characters outside `[0-9a-f:/%]`
and, on finding any, throws an `AddressError` whose `parseMessage` is
the whole input with each offending character wrapped:

```ts
const badCharacters = address.match(constants6.RE_BAD_CHARACTERS);

if (badCharacters) {
  throw new AddressError(
    `Bad character${badCharacters.length > 1 ? 's' : ''} detected in address: ${badCharacters.join('')}`,
    address.replace(constants6.RE_BAD_CHARACTERS, '<span class="parse-error">$1</span>'),
  );
}
```

`RE_BAD_CHARACTERS` is `/([^0-9a-f:/%])/gi`. For an input made entirely
of punctuation the `match` allocates one string per character, the
`join` copies them all into the message, and the `replace` produces a
string 34 times the input. Nothing before this point looks at the
length: the constructor strips a CIDR suffix and a zone identifier and
hands the rest to `parse()`. The `RE_BAD_ADDRESS` branch below it builds
its diagnostic the same way at about a third of the ratio, for input in
the hex-and-colon alphabet such as `fffff:` repeated.

`parse()` is reached only through the constructor, so every entry point
that constructs an `Address6` from a string it has not already bounded
is affected: `new Address6()`, `isValid()`, both arguments of
`fromAddressAndMask()` and `fromAddressAndWildcardMask()`,
`fromWildcard()`, and the prefix argument of `fromAddress4Nat64()` and
`toAddress4Nat64()`. `fromURL()` admits only hex, colons, and dots in a
host, so it reaches the `RE_BAD_ADDRESS` branch and not the other.
`fromArpa()` caps its input at 32 nibbles before constructing anything,
and `fromBigInt()`, `fromByteArray()`, and `fromAddress4()` build the
string themselves, so those are unaffected.

The `replace` is where size becomes fatal. V8 caps a string at 2^29 - 24
characters, so past 16 MiB of input the `replace` throws `RangeError:
Invalid string length` rather than the `AddressError` callers catch;
`isValid()` swallows it, but a constructor call guarded by `instanceof
AddressError` does not. Past 32 MiB the replacement builder's internal
array exceeds its maximum size and V8 aborts the process with `Fatal
JavaScript invalid size error`, which no `try`/`catch` intercepts.

##### Affected versions

`<= 10.7.0`. The diagnostic has had this shape since the parser was
written, so every release is affected.

##### Impact

`Address6.isValid()` on N bytes of `!`, measured on node 24.19.0:

| Input | Wall time | Transient heap | Outcome |
|---|---|---|---|
| 16 KiB | 1 ms | 1 MB | `false` |
| 1 MiB | 73 ms | 112 MB | `false` |
| 8 MiB | 464 ms | 784 MB | `false` |
| 16 MiB | | | `RangeError: Invalid string length` from the constructor;
`isValid()` returns `false` |
| 32 MiB | | | the process aborts |

The parse is synchronous, so the event loop is blocked for the whole of
the wall time and nothing else on that process is served. The heap is
transient and is reclaimed after the call returns, so memory does not
accumulate across requests; the abort at 32 MiB is a single request.
`Address4` has no diagnostic of this shape and parses the same 8 MiB in
a few milliseconds.

##### Reachability

Reaching the sizes above requires that the application hand the parser a
string it has not already bounded. A host taken from a URL or an HTTP
header is bounded by the server's header limit (Node's default is 16
KB), and at that size the cost is a millisecond. The megabyte sizes need
a request body the application accepts at that scale and passes through
unchecked. Common body parsers default to between 100 KB and 1 MB, which
caps the effect at a stall of under 100 ms per request, and the abort
needs 32 MiB in a single field, which no default admits. The severity is
scored for the stall, not the abort: an application that accepts 32 MiB
bodies into an address parser is the exception, and the reader running
one should treat this as a crash.

##### Proof of concept

`npm i ip-address@10.7.0`, then:

```js
const { Address6 } = require('ip-address');

for (const mib of [1, 8]) {
  const input = '!'.repeat(mib * 1024 * 1024);
  const before = process.memoryUsage().heapUsed;
  const start = process.hrtime.bigint();

  Address6.isValid(input);

  const ms = Number(process.hrtime.bigint() - start) / 1e6;
  const mb = (process.memoryUsage().heapUsed - before) / 1048576;

  console.log(`${mib} MiB: ${ms.toFixed(0)} ms, ${mb.toFixed(0)} MB`);
}

try {
  new Address6('!'.repeat(16 * 1024 * 1024));
} catch (e) {
  console.log(`16 MiB: ${e.name}: ${e.message}`);
}

new Address6('!'.repeat(32 * 1024 * 1024));
```

On affected versions (node 24.19.0):

```
1 MiB: 73 ms, 112 MB
8 MiB: 464 ms, 784 MB
16 MiB: RangeError: Invalid string length

#

##### Fatal error in , line 0
##### Fatal JavaScript invalid size error 142606336

#
```

The last line is V8 terminating the process; the script does not reach
its end.

##### Remediation

Upgrade to the patched release. In the fix, the constructor rejects an
address longer than the family allows before `parse()` runs: 45
characters for IPv6 once the CIDR suffix and zone identifier are
stripped (six four-digit groups, six colons, and a dotted quad, the same
line CPython's `ipaddress` module draws), and 15 characters for IPv4.
The rejection is an `AddressError` with no `parseMessage`, so
`isValid()` returns `false` for the cost of a length comparison and the
32 MiB input above is rejected in the same time as a 46-character one. A
zone identifier is not counted, since it never reaches the diagnostic.

This rejects nothing a previous release accepted: every string longer
than the limit already failed to parse.

If you cannot upgrade immediately, reject a candidate longer than an
address with a zone identifier can be before you parse it:

```js
if (host.length > 64) throw new Error('not an IP address');
```

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-101911](https://nvd.nist.gov/vuln/detail/CVE-2026-101911)
-
[https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134](https://redirect.github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134)
-
[https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5](https://redirect.github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.7.1)
-
[https://github.com/advisories/GHSA-h3mg-xc3c-68pw](https://redirect.github.com/advisories/GHSA-h3mg-xc3c-68pw)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-h3mg-xc3c-68pw)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### ip-address: isInSubnet() and isHostInSubnet() compare addresses of
different families as if they shared an address space, allowing an
allowlist check to admit an address outside its range
[CVE-2026-101912](https://nvd.nist.gov/vuln/detail/CVE-2026-101912) /
[GHSA-j6r3-76f7-8jcv](https://redirect.github.com/advisories/GHSA-j6r3-76f7-8jcv)

<details>
<summary>More information</summary>

#### Details
##### Summary

`isInSubnet()` and `isHostInSubnet()` accept an address of either family
and compare masked binary strings without checking that both operands
are the same family. `Address4` pads to 32 bits and `Address6` to 128,
so whenever the leading bits agree the strings are equal: `new
Address6('a00::1').isInSubnet(new Address4('10.0.0.0/8'))` is `true`,
and `new Address4('32.0.0.1').isInSubnet(new Address6('2000::/3'))` is
`true`. No IPv4 address is inside an IPv6 network, so both answers are
untrue.

An application that parses untrusted input as whichever family accepts
it and then tests the result against a fixed-family allowlist can admit
an address outside the list.

##### Details

Both methods are in `src/common.ts`:

```ts
export function isInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
  if (this.subnetMask < address.subnetMask) {
    return false;
  }

  return isHostInSubnet.call(this, address);
}

export function isHostInSubnet(this: Address4 | Address6, address: Address4 | Address6) {
  return this.mask(address.subnetMask) === address.mask();
}
```

`mask(n)` returns the first `n` bits of the address as a string of `0`
and `1`, taken from a representation padded to the family's width. `new
Address6('a00::1').mask(8)` is `'00001010'`, and so is `new
Address4('10.0.0.0/8').mask()`, so string equality reports containment.
The signature admits either family on either side, so TypeScript raises
nothing, and the `v4` property on `Address6` marks IPv4 notation
(`::ffff:10.0.0.1`) rather than family, so it does not discriminate
either.

Which cross-family pairs coincide depends on the network's prefix
length. `mask(n)` on an `Address4` returns at most 32 bits, so an IPv6
network longer than `/32` never matches an IPv4 address, and an IPv6
network of `/32` or shorter matches exactly the IPv4 addresses whose
leading bits equal its prefix. An IPv4 network is at most 32 bits and
matches every IPv6 address whose leading bits equal its prefix.

##### Affected versions

`<= 10.7.0`. The comparison has had this shape since the methods were
written, so every release is affected.

##### Impact

| Expression | Result | Reason |
|---|---|---|
| `new Address6('a00::1').isInSubnet(new Address4('10.0.0.0/8'))` |
`true` | both mask to `00001010` |
| `new Address4('10.0.0.1').isInSubnet(new Address6('a00::/8'))` |
`true` | the same bits, reversed |
| `new Address4('32.0.0.1').isInSubnet(new Address6('2000::/3'))` |
`true` | both begin `001` |
| `new Address4('32.1.13.184').isInSubnet(new
Address6('2001:db8::/32'))` | `true` | the `/32` spells an IPv4 address
|
| `new Address6('cb00:7100::1').isInSubnet(new
Address4('203.0.113.0/24'))` | `true` | the `/24` spells an IPv6 prefix
|
| `new Address4('10.0.0.1').isInSubnet(new
Address6('::ffff:10.0.0.0/104'))` | `false` | `/104` is longer than 32
bits |
| `new Address4('8.8.8.8').isInSubnet(new Address4('10.0.0.0/8'))` |
`false` | same-family control |

In the allowlist direction the check admits an address outside the list;
in the denylist direction it blocks an address outside the list. What
the coincidence can admit is narrow. An IPv6 allowlist of `/32` or
shorter admits the IPv4 addresses its prefix spells: `2001:db8::/32`
admits exactly `32.1.13.184`, and `2000::/3` admits `32.0.0.0/3`. Those
are public IPv4 addresses; the private, loopback, and link-local ranges
begin with bit patterns no allocated IPv6 prefix shares. An IPv4
allowlist admits the IPv6 addresses its prefix spells, and those all sit
in blocks IANA has not allocated. So a request admitted through this
defect reaches an address outside the intended list, not an internal
host, and the severity reflects that.

##### Proof of concept

`npm i ip-address@10.7.0`, then:

```js
const { Address4, Address6 } = require('ip-address');

// An allowlist of the application's own IPv6 range, tested against whichever
// family the input parses as.
const allowed = new Address6('2001:db8::/32');

function parse(host) {
  return Address4.isValid(host) ? new Address4(host) : new Address6(host);
}

for (const h of ['2001:db8::1', '2001:db9::1', '32.1.13.184', '32.1.13.185']) {
  console.log(parse(h).isInSubnet(allowed) ? 'ALLOW' : 'BLOCK', h);
}
```

On affected versions:

```
ALLOW 2001:db8::1
BLOCK 2001:db9::1
ALLOW 32.1.13.184
BLOCK 32.1.13.185
```

The IPv6 rows are right. The IPv4 address whose 32 bits equal the
allowlist's prefix is admitted; the one next to it is not.

##### Remediation

Upgrade to the patched release. In the fix, `isHostInSubnet()` returns
`false` when the two addresses are of different families, and
`isInSubnet()` inherits the answer. The methods keep accepting either
family so existing call sites compile. A caller that means to compare
across families converts first, with `Address6.fromAddress4()`, `to4()`,
or `toAddress4Nat64()`: `new
Address6('::ffff:10.0.0.1').to4().isInSubnet(new
Address4('10.0.0.0/8'))` is `true`, as before.

If you cannot upgrade immediately, compare the classes before you
compare the addresses:

```js
const contained = host.constructor === network.constructor && host.isInSubnet(network);
```

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-101912](https://nvd.nist.gov/vuln/detail/CVE-2026-101912)
-
[https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28](https://redirect.github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.7.1)
-
[https://github.com/advisories/GHSA-j6r3-76f7-8jcv](https://redirect.github.com/advisories/GHSA-j6r3-76f7-8jcv)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-j6r3-76f7-8jcv)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>beaugunderson/ip-address (ip-address)</summary>

###
[`v10.7.1`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.7.1)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.7.0...v10.7.1)

#### What's Changed

- Bump js-yaml and brace-expansion in the lockfile by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;226](https://redirect.github.com/beaugunderson/ip-address/pull/226)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.7.0...v10.7.1>

###
[`v10.7.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.7.0)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.6.0...v10.7.0)

#### What's Changed

- Add offset() and nextNetwork(), accept prefix-length ip6.arpa names,
correct the IPv6 end-address docs by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;225](https://redirect.github.com/beaugunderson/ip-address/pull/225)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.6.0...v10.7.0>

###
[`v10.6.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.6.0)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.5.1...v10.6.0)

#### What's Changed

- Add isGlobal() and pin the classifiers to the IANA special-purpose
registries by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;224](https://redirect.github.com/beaugunderson/ip-address/pull/224)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.5.1...v10.6.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-30 00:54:29 +00:00
dependabot[bot] 43d57924a9 chore(deps): bump nodemailer from 9.0.1 to 10.0.2 
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 9.0.1
to 10.0.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nodemailer/nodemailer/releases">nodemailer's
releases</a>.</em></p>
<blockquote>
<h2>v10.0.2</h2>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2">10.0.2</a>
(2026-09-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>mime-node:</strong> flatten nested recipient arrays without
recursion (<a
href="https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66">ebe0849</a>)</li>
<li><strong>shared:</strong> keep the TLS server name out of the DNS
cache (<a
href="https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe">a6512db</a>)</li>
</ul>
<h2>v10.0.1</h2>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v10.0.0...v10.0.1">10.0.1</a>
(2026-09-07)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>types:</strong> accept an explicit undefined for optional
properties (<a
href="https://github.com/nodemailer/nodemailer/commit/209719dd6a192656a6b18de265a3b4ac387208ff">209719d</a>),
closes <a
href="https://redirect.github.com/nodemailer/nodemailer/issues/1853">#1853</a></li>
<li><strong>types:</strong> drop the internal members from the published
declarations (<a
href="https://github.com/nodemailer/nodemailer/commit/81e64eaee70aabf867afef88d3733556c9fcc1cc">81e64ea</a>)</li>
</ul>
<h2>v10.0.0</h2>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.0">10.0.0</a>
(2026-09-03)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>Node.js 20 or newer is required. The Node.js 6 syntax compatibility
check and the .npmignore file are gone.</li>
</ul>
<h3>Features</h3>
<ul>
<li>keep the <code>@​types/nodemailer</code> type layout working (<a
href="https://github.com/nodemailer/nodemailer/commit/1cc535627e1bb672214b09fa4cc503567275fd7f">1cc5356</a>)</li>
<li>migrate to TypeScript with ES module and CommonJS builds (<a
href="https://github.com/nodemailer/nodemailer/commit/f7cbf8384e0ea6055efcc514afb8bc070ac3a2b1">f7cbf83</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>apply the other keys of a configuration object next to its url (<a
href="https://github.com/nodemailer/nodemailer/commit/29610f9fe04dbd8af04c4a3362f3b68d293592da">29610f9</a>)</li>
<li><strong>dkim:</strong> canonicalize raw messages the way verifiers
do (<a
href="https://github.com/nodemailer/nodemailer/commit/2c84b117d4d138751e9ffa8607f3796771bb5e66">2c84b11</a>)</li>
<li>keep a transporter assignable to the plain Transporter type (<a
href="https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551">8bf55fb</a>)</li>
<li><strong>shared:</strong> keep a colon in the user name of a
connection or proxy url (<a
href="https://github.com/nodemailer/nodemailer/commit/6acf4b67d919971f516f58940113c9b8598b2254">6acf4b6</a>)</li>
<li><strong>shared:</strong> refuse URL hosts the legacy parser would
truncate (<a
href="https://github.com/nodemailer/nodemailer/commit/17a5068f06e62fc04e1d5545ed70d4248bef258e">17a5068</a>)</li>
<li><strong>shared:</strong> resolve hostnames when the runtime has no
interface table (<a
href="https://github.com/nodemailer/nodemailer/commit/8b032407135ea05ae377e623a7021705a4a139d0">8b03240</a>)</li>
<li><strong>smtp-connection:</strong> clear the timers of a connection
dropped before the greeting (<a
href="https://github.com/nodemailer/nodemailer/commit/01dcaa05b212aafc33747041027fb8c66497e0eb">01dcaa0</a>)</li>
<li><strong>smtp-connection:</strong> keep an incomplete server reply
out of lastServerResponse (<a
href="https://github.com/nodemailer/nodemailer/commit/1a6e4271adb808509adf11832ad1adfdfc05c31b">1a6e427</a>)</li>
<li><strong>smtp-pool:</strong> free the pool slot when the proxy socket
can not be opened (<a
href="https://github.com/nodemailer/nodemailer/commit/204a344f7e4068ff41385195ee394a223ebadd84">204a344</a>)</li>
<li><strong>well-known:</strong> keep
nodemailer/lib/well-known/services.json available (<a
href="https://github.com/nodemailer/nodemailer/commit/367730cce85bc78c7804405c2cc7d89d93aafdd1">367730c</a>)</li>
</ul>
<h2>v9.1.1</h2>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1">9.1.1</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md">nodemailer's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v10.0.1...v10.0.2">10.0.2</a>
(2026-09-09)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>mime-node:</strong> flatten nested recipient arrays without
recursion (<a
href="https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66">ebe0849</a>)</li>
<li><strong>shared:</strong> keep the TLS server name out of the DNS
cache (<a
href="https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe">a6512db</a>)</li>
</ul>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v10.0.0...v10.0.1">10.0.1</a>
(2026-09-07)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>types:</strong> accept an explicit undefined for optional
properties (<a
href="https://github.com/nodemailer/nodemailer/commit/209719dd6a192656a6b18de265a3b4ac387208ff">209719d</a>),
closes <a
href="https://redirect.github.com/nodemailer/nodemailer/issues/1853">#1853</a></li>
<li><strong>types:</strong> drop the internal members from the published
declarations (<a
href="https://github.com/nodemailer/nodemailer/commit/81e64eaee70aabf867afef88d3733556c9fcc1cc">81e64ea</a>)</li>
</ul>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.0">10.0.0</a>
(2026-09-03)</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li>Node.js 20 or newer is required. The Node.js 6 syntax compatibility
check and the .npmignore file are gone.</li>
</ul>
<h3>Features</h3>
<ul>
<li>keep the <code>@​types/nodemailer</code> type layout working (<a
href="https://github.com/nodemailer/nodemailer/commit/1cc535627e1bb672214b09fa4cc503567275fd7f">1cc5356</a>)</li>
<li>migrate to TypeScript with ES module and CommonJS builds (<a
href="https://github.com/nodemailer/nodemailer/commit/f7cbf8384e0ea6055efcc514afb8bc070ac3a2b1">f7cbf83</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>apply the other keys of a configuration object next to its url (<a
href="https://github.com/nodemailer/nodemailer/commit/29610f9fe04dbd8af04c4a3362f3b68d293592da">29610f9</a>)</li>
<li><strong>dkim:</strong> canonicalize raw messages the way verifiers
do (<a
href="https://github.com/nodemailer/nodemailer/commit/2c84b117d4d138751e9ffa8607f3796771bb5e66">2c84b11</a>)</li>
<li>keep a transporter assignable to the plain Transporter type (<a
href="https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551">8bf55fb</a>)</li>
<li><strong>shared:</strong> keep a colon in the user name of a
connection or proxy url (<a
href="https://github.com/nodemailer/nodemailer/commit/6acf4b67d919971f516f58940113c9b8598b2254">6acf4b6</a>)</li>
<li><strong>shared:</strong> refuse URL hosts the legacy parser would
truncate (<a
href="https://github.com/nodemailer/nodemailer/commit/17a5068f06e62fc04e1d5545ed70d4248bef258e">17a5068</a>)</li>
<li><strong>shared:</strong> resolve hostnames when the runtime has no
interface table (<a
href="https://github.com/nodemailer/nodemailer/commit/8b032407135ea05ae377e623a7021705a4a139d0">8b03240</a>)</li>
<li><strong>smtp-connection:</strong> clear the timers of a connection
dropped before the greeting (<a
href="https://github.com/nodemailer/nodemailer/commit/01dcaa05b212aafc33747041027fb8c66497e0eb">01dcaa0</a>)</li>
<li><strong>smtp-connection:</strong> keep an incomplete server reply
out of lastServerResponse (<a
href="https://github.com/nodemailer/nodemailer/commit/1a6e4271adb808509adf11832ad1adfdfc05c31b">1a6e427</a>)</li>
<li><strong>smtp-pool:</strong> free the pool slot when the proxy socket
can not be opened (<a
href="https://github.com/nodemailer/nodemailer/commit/204a344f7e4068ff41385195ee394a223ebadd84">204a344</a>)</li>
<li><strong>well-known:</strong> keep
nodemailer/lib/well-known/services.json available (<a
href="https://github.com/nodemailer/nodemailer/commit/367730cce85bc78c7804405c2cc7d89d93aafdd1">367730c</a>)</li>
</ul>
<h2><a
href="https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1">9.1.1</a>
(2026-09-01)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>mailer:</strong> apply the message access policy in
resolveContent (<a
href="https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474">dc48ed3</a>)</li>
<li><strong>mailer:</strong> keep message data from reopening the access
sandbox (<a
href="https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b">ab7ef34</a>)</li>
<li><strong>mime-node:</strong> inherit the access policy from the tree
a node hangs in (<a
href="https://github.com/nodemailer/nodemailer/commit/262d550b1e121e3ff4ef6675d6771a5b2b4ddcec">262d550</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/01957998adab6c56b3f63c17a39a72a3ff18f3f4"><code>0195799</code></a>
chore(master): release 10.0.2 (<a
href="https://redirect.github.com/nodemailer/nodemailer/issues/1855">#1855</a>)</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/d456fd68dfb559392af5b0f0926979d4c5e3ef67"><code>d456fd6</code></a>
test: resolve the TLS server name test host without a resolver stub</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/ebe084940aef88278afc6016b78c6d1c3821bb66"><code>ebe0849</code></a>
fix(mime-node): flatten nested recipient arrays without recursion</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/a6512dbcb3c6e7f2f70d3acccc5752defe3c61fe"><code>a6512db</code></a>
fix(shared): keep the TLS server name out of the DNS cache</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/40d52215aac65b811d7e131bc916f68605efd9d2"><code>40d5221</code></a>
chore(master): release 10.0.1 (<a
href="https://redirect.github.com/nodemailer/nodemailer/issues/1854">#1854</a>)</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/81e64eaee70aabf867afef88d3733556c9fcc1cc"><code>81e64ea</code></a>
fix(types): drop the internal members from the published
declarations</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/c5dba6e2c6e3705d046a26663fef0e4bda13c0fa"><code>c5dba6e</code></a>
chore: turn on exactOptionalPropertyTypes for the type-check</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/209719dd6a192656a6b18de265a3b4ac387208ff"><code>209719d</code></a>
fix(types): accept an explicit undefined for optional properties</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/2ee030ca78c18db4b1f7e040fdce285c51972a96"><code>2ee030c</code></a>
chore(master): release 10.0.0 (<a
href="https://redirect.github.com/nodemailer/nodemailer/issues/1852">#1852</a>)</li>
<li><a
href="https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551"><code>8bf55fb</code></a>
fix: keep a transporter assignable to the plain Transporter type</li>
<li>Additional commits viewable in <a
href="https://github.com/nodemailer/nodemailer/compare/v9.0.1...v10.0.2">compare
view</a></li>
</ul>
</details>
<details>
<summary>Install script changes</summary>
<p>This version adds <code>prepare</code> script that runs during
installation. Review the package contents before updating.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodemailer&package-manager=npm_and_yarn&previous-version=9.0.1&new-version=10.0.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/bricks-software/unleash-enterprise/network/alerts).

</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Simon Hornby <simon@getunleash.io>
Co-authored-by: Simon Hornby <liquidwicked64@gmail.com>
 2026-09-29 15:04:11 +02:00
Mateusz Kwasniewski 865d2d5ae7 test: improved playground tests 2026-09-29 12:23:17 +02:00
renovate[bot] 0f5cbc7633 chore(deps): update dependency @types/node to v22.20.4 (#12682) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.20.3` →
`22.20.4`](https://renovatebot.com/diffs/npm/@types%2fnode/22.20.3/22.20.4)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.20.3/22.20.4?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-28 22:28:15 +00:00
renovate[bot] d1887556ba fix(deps): update dependency ip-address to v10.5.1 [security] (#12686) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) |
[`10.3.1` →
`10.5.1`](https://renovatebot.com/diffs/npm/ip-address/10.3.1/10.5.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ip-address/10.5.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ip-address/10.3.1/10.5.1?slim=true)
|

---

### ip-address: no classifier recognizes the NAT64 local-use range
64:ff9b:1::/48, allowing SSRF and trust-boundary bypass
[CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910) /
[GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc)

<details>
<summary>More information</summary>

#### Details
##### Summary

No classifier on `Address6` recognizes the NAT64 local-use range
`64:ff9b:1::/48` (RFC 8215). `isPrivate()`, `isLoopback()`,
`isLinkLocal()` and their siblings all return `false` for every address
in it, so an internal IPv4 destination written through a local-use NAT64
prefix (`64:ff9b:1:7f00:0:100::` for `127.0.0.1`,
`64:ff9b:1:a9fe:a9:fe00::` for `169.254.169.254`) reads as an ordinary
global address. `getType()` names the range `'NAT64 (local-use)'`, so
the library knows what the address is and classifies it as nothing.

An application that builds a network trust-boundary decision on these
checks (for example a filter intended to block Server-Side Request
Forgery, or SSRF) will classify an internal target as external and allow
the request. SSRF is an attack in which a user-supplied address coaxes
the server into making a request to an internal destination the user
could not otherwise reach, such as a loopback service or a cloud
metadata endpoint.

##### Details

The fix for GHSA-22jq-vg5j-6vgg (10.2.1) classifies IPv4-mapped
(`::ffff:0:0/96`) and NAT64 well-known (`64:ff9b::/96`) addresses by
their embedded IPv4 address: `embeddedIPv4()` in `src/ipv6.ts` decodes
the trailing 32 bits and every special-use classifier delegates to the
resulting `Address4`. Those are the only two ranges `embeddedIPv4()`
handles.

The local-use range differs in kind from the well-known prefix, which is
why extending the decoder does not fix it. RFC 8215 reserves
`64:ff9b:1::/48` so an operator can carve their own NAT64 prefix out of
it, of any length RFC 6052 allows (`/48`, `/56`, `/64`, or `/96`). Where
the IPv4 address sits depends on that choice: `127.0.0.1` is
`64:ff9b:1:7f00:0:100::` under a `/48` prefix and `64:ff9b:1::7f00:1`
under a `/96` prefix, and each of those decodes to a different address
under the other prefix length. There is no single embedded IPv4 address
for the library to classify by.

What is well-defined is the range as a whole. The IANA IPv6
Special-Purpose Address Registry lists `64:ff9b:1::/48` as not globally
reachable, and Python's `ipaddress` module reports `is_private` as
`True` and `is_global` as `False` for every address in it. `isPrivate()`
covered ULA (`fc00::/7`) plus the decoded mapped and well-known cases,
and nothing in the local-use range.

##### Affected versions

`>= 10.2.0, <= 10.5.0`. The `is*` classification API was extended to
`Address6` in 10.2.0; releases before it do not expose the method and
are not affected through this vector.

##### Impact

Every address in `64:ff9b:1::/48` parses successfully, `isValid()` is
`true`, and no classifier catches it. Which internal target is reached
depends on the NAT64 prefix deployed on the server's network; the
well-known prefix column is the patched control from
GHSA-22jq-vg5j-6vgg.

| Internal target | Well-known form | Classified | Local-use form (`/48`
prefix) | Classified |
|---|---|---|---|---|
| `127.0.0.1` | `64:ff9b::7f00:1` | loopback | `64:ff9b:1:7f00:0:100::`
| nothing |
| `10.0.0.1` | `64:ff9b::a00:1` | private | `64:ff9b:1:a00:0:100::` |
nothing |
| `169.254.169.254` | `64:ff9b::a9fe:a9fe` | link-local |
`64:ff9b:1:a9fe:a9:fe00::` | nothing |
| `192.168.1.1` | `64:ff9b::c0a8:101` | private |
`64:ff9b:1:c0a8:1:100::` | nothing |

##### Reachability

Reaching an internal host through one of these addresses requires that
the server's network run a NAT64 translator on a prefix inside
`64:ff9b:1::/48` and that the attacker guess or know the prefix length.
That is the same precondition the well-known prefix carries (a
translator on `64:ff9b::/96`), with the additional constraint that the
prefix is operator-chosen rather than fixed. The severity reflects that
precondition.

##### Proof of concept

`npm i ip-address@10.5.0`, then:

```js
const { Address6 } = require('ip-address');

// A guard of the shape the library documents.
function isBlocked(host) {
  const a = new Address6(host);
  return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();
}

for (const h of ['64:ff9b::7f00:1', '64:ff9b:1:7f00:0:100::', '64:ff9b:1::7f00:1']) {
  console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', new Address6(h).getType());
}
```

On affected versions:

```
BLOCK 64:ff9b::7f00:1 -> getType() NAT64 (well-known)
ALLOW 64:ff9b:1:7f00:0:100:: -> getType() NAT64 (local-use)
ALLOW 64:ff9b:1::7f00:1 -> getType() NAT64 (local-use)
```

##### Remediation

Upgrade to the patched release. In the fix, `isPrivate()` returns `true`
for every address in `64:ff9b:1::/48`, alongside ULA and the decoded
mapped and well-known cases. The range is reported private as a whole
rather than by a decoded IPv4 address, for the reason given above;
`toAddress4Nat64(prefix)` remains the way to decode an address under a
known deployment prefix. `isLoopback()` and `isLinkLocal()` are
unchanged for this range, since without the prefix length the library
cannot know which IPv4 address is embedded.

If you cannot upgrade immediately, test the range directly:

```js
const NAT64_LOCAL_USE = new Address6('64:ff9b:1::/48');
const localUse = new Address6(host).isHostInSubnet(NAT64_LOCAL_USE);
```

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-101910](https://nvd.nist.gov/vuln/detail/CVE-2026-101910)
-
[https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8](https://redirect.github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.5.1)
-
[https://github.com/advisories/GHSA-2vr4-cq9g-pvrc](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-2vr4-cq9g-pvrc)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than
fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts
[CVE-2026-101913](https://nvd.nist.gov/vuln/detail/CVE-2026-101913) /
[GHSA-rpw4-54j3-4h4q](https://redirect.github.com/advisories/GHSA-rpw4-54j3-4h4q)

<details>
<summary>More information</summary>

#### Details
##### Summary

`Address6.isLinkLocal()` recognizes `fe80::/64` rather than `fe80::/10`.
Link-local unicast is the whole `/10` under RFC 4291 §2.4 and the IANA
IPv6 Special-Purpose Address Registry, so the method returns `false` for
every link-local address outside the one `/64` that stateless address
autoconfiguration happens to use. `new
Address6('fe81::1').isLinkLocal()` is `false`.

The library contradicts itself on the same object: for `fe81::1`,
`getType()` returns `'Link-local unicast'`, `getScope()` returns `'Link
local'`, and `isHostInSubnet(new Address6('fe80::/10'))` returns `true`,
while `isLinkLocal()` returns `false`.

An application that builds a network trust-boundary decision on these
checks (for example a filter intended to block Server-Side Request
Forgery, or SSRF) will classify a link-local target as unremarkable and
allow the request. SSRF is an attack in which a user-supplied address
coaxes the server into making a request to an internal destination the
user could not otherwise reach.

##### Details

`isLinkLocal()` in `src/ipv6.ts` compares the first 64 bits of the
address against a literal string:

```ts
// Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'
if (
  this.getBitsBase2(0, 64) ===
  '1111111010000000000000000000000000000000000000000000000000000000'
) {
  return true;
}
```

The comparison requires the first 64 bits to be exactly
`fe80:0000:0000:0000`, so it accepts 2⁶⁴ of the 2¹¹⁸ addresses in
`fe80::/10`. The comment states a premise the library disproves:
`getType()` classifies the same range with `isHostInSubnet` against the
`'fe80::/10': 'Link-local unicast'` entry in `src/v6/constants.ts`, and
`Address4.isLinkLocal()` is a plain `isHostInSubnet` test against
`169.254.0.0/16`. RFC 4291 §2.5.6 constrains the format of an
autoconfigured link-local address; it does not define the range, and
reading it as the definition is the likeliest origin of the `/64`
comparison.

The IPv4-mapped and NAT64 well-known paths of `isLinkLocal()` are
unaffected: `::ffff:169.254.169.254` and `64:ff9b::a9fe:a9fe` are
classified by their embedded IPv4 address and report `true`.

##### Affected versions

`<= 10.5.0`. The comparison has had this shape since
`Address6.isLinkLocal()` was introduced, so every release exposing the
method is affected.

##### Impact

Every well-formed address in `fe80::/10` outside `fe80::/64` is parsed
successfully, `isValid()` is `true`, and the classifier reports
something untrue about it. No other classifier catches these addresses:
`isPrivate()` covers ULA (`fc00::/7`), not link-local.

| Address | `isLinkLocal()` | `getType()` | `getScope()` |
|---|---|---|---|
| `fe80::1` | `true` | Link-local unicast | Link local |
| `fe81::1` | `false` | Link-local unicast | Link local |
| `fe8f::1` | `false` | Link-local unicast | Link local |
| `febf::1` | `false` | Link-local unicast | Link local |
| `fe80:0:0:1::1` | `false` | Link-local unicast | Link local |
| `fe80::1:0:0:0:1` | `false` | Link-local unicast | Link local |

Python's `ipaddress` module, the `IN6_IS_ADDR_LINKLOCAL` macro in
`netinet6/in6.h`, and Linux's `ipv6_addr_type()` all apply a ten-bit
prefix test and classify every row above as link-local.

A request admitted through a guard built on `isLinkLocal()` reaches a
link-local host on the server's own segment: a neighboring machine or
the on-link router. An IPv6 link-local destination generally needs a
zone index and a neighbor on the same link, so the reach is the server's
own segment rather than the internet or a universal metadata endpoint,
and the severity reflects that.

##### Proof of concept

`npm i ip-address@10.5.0`, then:

```js
const { Address6 } = require('ip-address');

// A guard of the shape the library documents.
function isBlocked(host) {
  const a = new Address6(host);
  return a.isLoopback() || a.isLinkLocal() || a.isPrivate() || a.isMulticast() || a.isUnspecified();
}

for (const h of ['fe80::1', 'fe81::1', 'febf::1', 'fe80:0:0:1::1']) {
  const a = new Address6(h);
  console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h, '-> getType()', a.getType());
}
```

On affected versions:

```
BLOCK fe80::1 -> getType() Link-local unicast
ALLOW fe81::1 -> getType() Link-local unicast
ALLOW febf::1 -> getType() Link-local unicast
ALLOW fe80:0:0:1::1 -> getType() Link-local unicast
```

##### Remediation

Upgrade to the patched release. In the fix, `isLinkLocal()` tests the
address against `fe80::/10` with the same `isHostInSubnet` predicate
`getType()` and `Address4.isLinkLocal()` use. The same release adds
`2001::/32` to the type table so `getType()` reports `'Teredo'` for the
addresses `isTeredo()` returns `true` for; that is a consistency
correction with no security effect.

If you cannot upgrade immediately, test the range directly:

```js
const LINK_LOCAL = new Address6('fe80::/10');
const linkLocal = new Address6(host).isHostInSubnet(LINK_LOCAL);
```

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

#### Severity
- CVSS Score: 6.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-101913](https://nvd.nist.gov/vuln/detail/CVE-2026-101913)
-
[https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546](https://redirect.github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.5.1)
-
[https://github.com/advisories/GHSA-rpw4-54j3-4h4q](https://redirect.github.com/advisories/GHSA-rpw4-54j3-4h4q)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-rpw4-54j3-4h4q)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>beaugunderson/ip-address (ip-address)</summary>

###
[`v10.5.1`](https://redirect.github.com/beaugunderson/ip-address/compare/v10.5.0...38b02d73cfc0724f9ad61c65b6328e116eac03ec)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.5.0...v10.5.1)

###
[`v10.5.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.5.0)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.4.0...v10.5.0)

##### What's Changed

- Honor the fromURL graceful-failure contract for non-IPv6 hosts by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;218](https://redirect.github.com/beaugunderson/ip-address/pull/218)
- Correct the documentation where it disagreed with the library by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;219](https://redirect.github.com/beaugunderson/ip-address/pull/219)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.4.0...v10.5.0>

###
[`v10.4.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.4.0)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.3.1...v10.4.0)

#### What's Changed

- Add GitHub Actions CI by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;213](https://redirect.github.com/beaugunderson/ip-address/pull/213)
- Keep the package loadable on node 12, and enforce it by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;216](https://redirect.github.com/beaugunderson/ip-address/pull/216)
- Validate the byte arrays Address6 is given by
[@&#8203;beaugunderson](https://redirect.github.com/beaugunderson) in
[#&#8203;217](https://redirect.github.com/beaugunderson/ip-address/pull/217)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.3.1...v10.4.0>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjExMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-28 22:26:42 +00:00
dependabot[bot] 4bdd5471bb chore(deps): bump js-yaml from 4.3.1 to 4.3.2 2026-09-23 14:36:41 +02:00
renovate[bot] 62fc46b7df chore(deps): update dependency @types/node to v22.20.3 (#12675) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.20.2` →
`22.20.3`](https://renovatebot.com/diffs/npm/@types%2fnode/22.20.2/22.20.3)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.20.2/22.20.3?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMDMuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjEwMy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-23 12:10:36 +00:00
renovate[bot] c471bec671 chore(deps): update dependency @types/node to v22.20.2 (#12656) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.20.1` →
`22.20.2`](https://renovatebot.com/diffs/npm/@types%2fnode/22.20.1/22.20.2)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.20.1/22.20.2?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45NC4wIiwidXBkYXRlZEluVmVyIjoiNDQuOTQuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-17 02:41:12 +00:00
renovate[bot] ebac51753c chore(deps): update dependency fast-check to v4.9.0 (#12627) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-check](https://fast-check.dev/)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check))
| [`4.8.0` →
`4.9.0`](https://renovatebot.com/diffs/npm/fast-check/4.8.0/4.9.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fast-check/4.9.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-check/4.8.0/4.9.0?slim=true)
|

---

### Release Notes

<details>
<summary>dubzzz/fast-check (fast-check)</summary>

###
[`v4.9.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#490)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.8.0...v4.9.0)

*Shrinkable `entityGraph` and few performance chips*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.9.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.8.0...v4.9.0)]

#### Features

- ([PR#7008](https://redirect.github.com/dubzzz/fast-check/pull/7008))
Towards shrinkable `entityGraph` thanks to `chainUntil`

#### Fixes

- ([PR#7010](https://redirect.github.com/dubzzz/fast-check/pull/7010))
Bug: Fix latent state-sharing bug in entityGraph
- ([PR#7063](https://redirect.github.com/dubzzz/fast-check/pull/7063))
Bug: Equiprobable alternatives in `stringMatching`
- ([PR#6973](https://redirect.github.com/dubzzz/fast-check/pull/6973))
CI: Drop caches on push for build package flow
- ([PR#6971](https://redirect.github.com/dubzzz/fast-check/pull/6971))
CI: Only mark fast-check's releases as latest
- ([PR#6974](https://redirect.github.com/dubzzz/fast-check/pull/6974))
CI: Drop pull\_request\_target flows
- ([PR#6975](https://redirect.github.com/dubzzz/fast-check/pull/6975))
CI: Drop discussion creation on release publish
- ([PR#6976](https://redirect.github.com/dubzzz/fast-check/pull/6976))
CI: Drop caches from publication steps
- ([PR#6977](https://redirect.github.com/dubzzz/fast-check/pull/6977))
CI: Revert "Drop caches from publication steps"
- ([PR#6978](https://redirect.github.com/dubzzz/fast-check/pull/6978))
CI: Make zizmor audit a required status check
- ([PR#6991](https://redirect.github.com/dubzzz/fast-check/pull/6991))
CI: Remove Claude Code workflow
- ([PR#6994](https://redirect.github.com/dubzzz/fast-check/pull/6994))
CI: Replace `pnpm dlx` with `pnpm exec` for `pkg-pr-new`
- ([PR#6995](https://redirect.github.com/dubzzz/fast-check/pull/6995))
CI: Inline zizmor ignores in workflow
- ([PR#6996](https://redirect.github.com/dubzzz/fast-check/pull/6996))
CI: Move to `devEngines.packageManager`
- ([PR#7005](https://redirect.github.com/dubzzz/fast-check/pull/7005))
CI: Update PULL\_REQUEST\_TEMPLATE.md
- ([PR#7011](https://redirect.github.com/dubzzz/fast-check/pull/7011))
CI: Drop OTP prompt from npm publish
- ([PR#7013](https://redirect.github.com/dubzzz/fast-check/pull/7013))
CI: Switch release jobs to npm stage publish
- ([PR#7027](https://redirect.github.com/dubzzz/fast-check/pull/7027))
CI: Run benchmarks against `main`
- ([PR#7037](https://redirect.github.com/dubzzz/fast-check/pull/7037))
CI: Use comparison mode for `bench`
- ([PR#7069](https://redirect.github.com/dubzzz/fast-check/pull/7069))
CI: Run pnpm dedupe to deduplicate lockfile
- ([PR#6959](https://redirect.github.com/dubzzz/fast-check/pull/6959))
CI: Announce releases on Bluesky
- ([PR#7105](https://redirect.github.com/dubzzz/fast-check/pull/7105))
CI: Switch to actions/attest for attestations
- ([PR#7117](https://redirect.github.com/dubzzz/fast-check/pull/7117))
CI: Use pnpm version in changelog script
- ([PR#7120](https://redirect.github.com/dubzzz/fast-check/pull/7120))
CI: Allow unclean tree in changelog generation
- ([PR#7125](https://redirect.github.com/dubzzz/fast-check/pull/7125))
CI: Stage publish using `pnpm` in publish jobs
- ([PR#7065](https://redirect.github.com/dubzzz/fast-check/pull/7065))
Clean: Delete skills directory
- ([PR#6983](https://redirect.github.com/dubzzz/fast-check/pull/6983))
Doc: Tweak PR Template to hint AI agents into revealing themselves
- ([PR#7092](https://redirect.github.com/dubzzz/fast-check/pull/7092))
Doc: Add back skills directory
- ([PR#7095](https://redirect.github.com/dubzzz/fast-check/pull/7095))
Doc: Add release notes for fast-check 4.8.0
- ([PR#7104](https://redirect.github.com/dubzzz/fast-check/pull/7104))
Doc: Add makeeno as doc contributor
- ([PR#7103](https://redirect.github.com/dubzzz/fast-check/pull/7103))
Doc: Fix info box in docs
- ([PR#7108](https://redirect.github.com/dubzzz/fast-check/pull/7108))
Doc: Add jneidel as doc contributor
- ([PR#7035](https://redirect.github.com/dubzzz/fast-check/pull/7035))
Performance: Faster `fc.integer` on `generate`
- ([PR#7046](https://redirect.github.com/dubzzz/fast-check/pull/7046))
Performance: Faster fc.record on generate
- ([PR#7047](https://redirect.github.com/dubzzz/fast-check/pull/7047))
Performance: Faster fc.dictionary on generate
- ([PR#7048](https://redirect.github.com/dubzzz/fast-check/pull/7048))
Performance: Faster `fc.webPath`/`fc.webUrl` on `generate`
- ([PR#7050](https://redirect.github.com/dubzzz/fast-check/pull/7050))
Performance: Faster `fc.stringMatching` for `\W` `\D` `\S` `.`
- ([PR#7054](https://redirect.github.com/dubzzz/fast-check/pull/7054))
Performance: Faster `fc.stringMatching` on `generate`
- ([PR#7049](https://redirect.github.com/dubzzz/fast-check/pull/7049))
Performance: Drop nested `tuple` on `generate` for `fc.record`
- ([PR#7045](https://redirect.github.com/dubzzz/fast-check/pull/7045))
Performance: Faster `fc.entityGraph` on `generate`
- ([PR#7071](https://redirect.github.com/dubzzz/fast-check/pull/7071))
Performance: Early exit on empty tuple in `fc.entityGraph`
- ([PR#7004](https://redirect.github.com/dubzzz/fast-check/pull/7004))
Refactor: Extract code from `onTheFlyLinksForEntityGraph`
- ([PR#7006](https://redirect.github.com/dubzzz/fast-check/pull/7006))
Refactor: Move `generate` logic to the `Arbitrary` for `entityGraph`
- ([PR#7007](https://redirect.github.com/dubzzz/fast-check/pull/7007))
Refactor: Introduce `ProductionState` for `onTheFlyLinks...`
- ([PR#6990](https://redirect.github.com/dubzzz/fast-check/pull/6990))
Script: Skip scripts during `pnpm i` in changelog generation
- ([PR#7039](https://redirect.github.com/dubzzz/fast-check/pull/7039))
Script: More benchmark commands
- ([PR#6972](https://redirect.github.com/dubzzz/fast-check/pull/6972))
Security: Pass `--ignore-scripts` to `pnpm i` calls
- ([PR#7028](https://redirect.github.com/dubzzz/fast-check/pull/7028))
Test: Add benchmarks for key arbitraries
- ([PR#7034](https://redirect.github.com/dubzzz/fast-check/pull/7034))
Test: Expand benchmark coverage across arbitrary families
- ([PR#7041](https://redirect.github.com/dubzzz/fast-check/pull/7041))
Test: Add runners related benchs
- ([PR#7064](https://redirect.github.com/dubzzz/fast-check/pull/7064))
Test: Clarify arbitrary benchmark names
- ([PR#7068](https://redirect.github.com/dubzzz/fast-check/pull/7068))
Test: More reliable arbitraries.bench.ts
- ([PR#7088](https://redirect.github.com/dubzzz/fast-check/pull/7088))
Typo: Typo in type `EntityGraphContraints`

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42OS4xIiwidXBkYXRlZEluVmVyIjoiNDQuNjkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-08 22:42:39 +00:00
Github Actions Bot 66d4a45c1d 8.2.0 2026-09-08 09:56:49 +00:00
Krzysztof (Kris) Kula 9bfa93f9b0 chore(deps-dev): bump @faker-js/faker from 10.4.0 to 10.5.0 
fix security alert

And fix build
 2026-09-07 11:08:05 +02:00
Krzysztof (Kris) Kula 82725ceddb update sanitize-html to 2.17.7 2026-09-02 09:37:41 +00:00
renovate[bot] 0f2f128806 chore(deps): update dependency @types/pg to v8.23.1 (#12595) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/pg](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/pg)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg))
| [`8.20.4` →
`8.23.1`](https://renovatebot.com/diffs/npm/@types%2fpg/8.20.4/8.23.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fpg/8.23.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fpg/8.20.4/8.23.1?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-09-01 01:29:38 +00:00
Krzysztof (Kris) Kula bccdf46f4d chore: bump js-yaml to 4.3.1 
4.3.1 was already in the OSS lockfile, but we need to bump it manually
in enterprise
 2026-08-31 11:34:31 +01:00
renovate[bot] b376d1cf98 chore(deps): update dependency @types/nodemailer to v8 (#12031) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/nodemailer](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/nodemailer)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/nodemailer))
| [`^7.0.11` →
`^8.0.0`](https://renovatebot.com/diffs/npm/@types%2fnodemailer/7.0.12/8.0.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnodemailer/8.0.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnodemailer/7.0.12/8.0.1?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzMuNiIsInVwZGF0ZWRJblZlciI6IjQ0LjQ2LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-28 08:53:05 +02:00
renovate[bot] 42a9558572 chore(deps): update dependency @types/supertest to v7 (#12045) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/supertest](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/supertest)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest))
| [`6.0.3` →
`7.2.1`](https://renovatebot.com/diffs/npm/@types%2fsupertest/6.0.3/7.2.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fsupertest/7.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fsupertest/6.0.3/7.2.1?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzMuNiIsInVwZGF0ZWRJblZlciI6IjQ0LjQ2LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-28 08:52:35 +02:00
renovate[bot] 024a4a62ef chore(deps): update vitest monorepo to v4.1.11 (#12585) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@vitest/coverage-v8](https://vitest.dev/guide/coverage)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8))
| [`4.1.9` →
`4.1.11`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.9/4.1.11)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.9/4.1.11?slim=true)
|
| [@vitest/ui](https://vitest.dev/guide/ui)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/ui))
| [`4.1.9` →
`4.1.11`](https://renovatebot.com/diffs/npm/@vitest%2fui/4.1.9/4.1.11) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fui/4.1.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fui/4.1.9/4.1.11?slim=true)
|
| [vitest](https://vitest.dev)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
| [`4.1.10` →
`4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.10/4.1.11) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.11?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.10/4.1.11?slim=true)
|

---

### Release Notes

<details>
<summary>vitest-dev/vitest (@&#8203;vitest/coverage-v8)</summary>

###
[`v4.1.11`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.11)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11)

#####    🐞 Bug Fixes

- Revive global concurrency limit for test lifecycle \[backport to v4]
 -  by [@&#8203;sheremet-va](https://redirect.github.com/sheremet-va)
and [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa) in
[#&#8203;10992](https://redirect.github.com/vitest-dev/vitest/issues/10992)
[<samp>(5146d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5146df80b)
- **browser**:
- Encode iframeId in tester iframe URL \[backport to v4]  -  by
[@&#8203;sheremet-va](https://redirect.github.com/sheremet-va),
**Pduhard** and **Claude Opus 4.8** in
[#&#8203;10955](https://redirect.github.com/vitest-dev/vitest/issues/10955)
[<samp>(10b2c)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/10b2cd201)
- Trigger playwright/chromium gc on lower disk availability \[backport
to v4]  -  by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa),
**Hiroshi Ogawa** and **OpenCode** in
[#&#8203;10951](https://redirect.github.com/vitest-dev/vitest/issues/10951)
[<samp>(9851d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/9851dbc41)
- **mocker**:
- Restrict redirect mocks to the fs allowlist \[backport to v4]  -  by
[@&#8203;sheremet-va](https://redirect.github.com/sheremet-va) in
[#&#8203;10974](https://redirect.github.com/vitest-dev/vitest/issues/10974)
[<samp>(fe5a1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/fe5a11d3c)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11)

###
[`v4.1.10`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.10)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10)

#####    🐞 Bug Fixes

- **browser**: Check fs access in builtin commands \[backport to v4]  - 
by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa), **Hiroshi
Ogawa** and **OpenCode (claude-opus-4-8)** in
[#&#8203;10680](https://redirect.github.com/vitest-dev/vitest/issues/10680)
[<samp>(5c18d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/5c18dd267)
- **vm**: Fix external module resolve error with deps optimizer query
for encoded URI \[backport to v4]  -  by
[@&#8203;SveLil](https://redirect.github.com/SveLil) and
[@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa) in
[#&#8203;10661](https://redirect.github.com/vitest-dev/vitest/issues/10661)
[<samp>(bae52)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/bae52b511)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40Ni4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-27 22:17:53 +00:00
dependabot[bot] fe415f3301 chore(deps): bump vitest from 4.1.9 to 4.1.10 2026-08-21 07:36:06 +00:00
Jaanus Sellin e5b3977e5b chore(deps): bump unleash-client to ^6.12.1 (#12535) 
## What

Bump `unleash-client` from `^6.11.1` to `^6.12.1`.

## Why

`unleash-client@6.11.1` depends on `re2js@^1.2.2` (resolves to `1.4.x`),
while this package depends on `re2js@2.3.2` directly. The result is
**two major versions of the RE2 engine** resolved and loaded — a heap
snapshot of a live Unleash instance showed the re2js source present
twice (~0.6–1.3 MB of duplicated string + compiled code per process).

`unleash-client@6.12.1` depends on `re2js@^2.3.2`, so this bump dedupes
re2js to a single copy.
 2026-08-14 15:35:30 +03:00
renovate[bot] 4c23f127da chore(deps): update dependency @types/pg to v8.20.4 (#12533) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/pg](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/pg)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg))
| [`8.20.0` →
`8.20.4`](https://renovatebot.com/diffs/npm/@types%2fpg/8.20.0/8.20.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fpg/8.20.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fpg/8.20.0/8.20.4?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjQuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-13 19:44:27 +00:00
renovate[bot] 6dffb1e299 chore(deps): update dependency @types/lodash to v4.17.25 (#12526) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/lodash](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/lodash)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash))
| [`4.17.24` →
`4.17.25`](https://renovatebot.com/diffs/npm/@types%2flodash/4.17.24/4.17.25)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2flodash/4.17.25?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2flodash/4.17.24/4.17.25?slim=true)
|

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-10 21:37:38 +00:00
Github Actions Bot 9445b1e570 8.1.0 2026-08-05 10:56:48 +00:00
renovate[bot] 89877eeaf5 fix(deps): update dependency ip-address to v10.3.1 [security] (#12513) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) |
[`10.2.1` →
`10.3.1`](https://renovatebot.com/diffs/npm/ip-address/10.2.1/10.3.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ip-address/10.3.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ip-address/10.2.1/10.3.1?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### ip-address: a CIDR suffix on the parsed address suppresses
special-use classification and can bypass SSRF and trust-boundary checks
[CVE-2026-69198](https://nvd.nist.gov/vuln/detail/CVE-2026-69198) /
[GHSA-4xrf-jv44-h6hh](https://redirect.github.com/advisories/GHSA-4xrf-jv44-h6hh)

<details>
<summary>More information</summary>

#### Details
##### Summary

Every special-use classification method is built on `isInSubnet`, which
short-circuits to `false` whenever the address's own subnet mask is
*shorter* than the reference range's mask. That mask comes verbatim from
the CIDR suffix on the parsed input, so appending a suffix such as `/0`
suppresses classification entirely: `isLoopback()`, `isPrivate()`,
`isLinkLocal()`, `isCGNAT()`, `isMulticast()`, `isUnspecified()`,
`isBroadcast()`, `isULA()`, and `getType()` all report an internal
address as unremarkable, while `correctForm()` and `address` still
return the real internal target.

An application that builds a network trust-boundary decision on these
checks (for example a filter intended to block Server-Side Request
Forgery, or SSRF) may therefore treat an internal target as external and
allow the request. SSRF is an attack in which a user-supplied address
coaxes the server into making a request to an internal destination the
user could not otherwise reach, such as a loopback service or a cloud
metadata endpoint.

##### Details

`isInSubnet` in `src/common.ts` opens with a guard that compares the two
prefix lengths:

```js
export function isInSubnet(this, address) {
  if (this.subnetMask < address.subnetMask) {
    return false;                                  // <-- reached before any bit comparison
  }

  if (this.mask(address.subnetMask) === address.mask()) {
    return true;
  }

  return false;
}
```

That guard is correct for the question `isInSubnet` is named for —
whether one *network* is contained in another, where a `/0` network
genuinely is not inside a `/8`. It is wrong for classification, which
asks a question about the address itself and must not depend on the
prefix the caller happened to write. `/0` is shorter than every
reference prefix in the special-use tables (loopback `/8`, link-local
`/16`, CGNAT `/10`, ULA `/7`, multicast `/4`), so for a classification
call the bit comparison is never reached and the method returns `false`.

The underlying bit comparison is correct, and `mask(n)` already returns
the first `n` bits of the full parsed address independently of
`subnetMask` — the defect is solely that the containment guard sits in
the classification path. Host bits are retained through parsing, so
`correctForm()` still yields the real target and the address remains
fully usable for connecting.

`/0` is the universal case because it is shorter than every reference
prefix, but any suffix shorter than the specific range being tested has
the same effect: `10.0.0.5/7` defeats `isPrivate()` for `10.0.0.0/8`.

##### Affected versions

`>= 10.1.1, <= 10.2.1`. The `is*` classification API was introduced for
`Address4` in 10.1.1 and extended to `Address6` in 10.2.0; releases
before 10.1.1 do not expose it and are not affected through this vector.
The containment guard itself is much older, but `isInSubnet` alone is a
subnet-containment predicate whose behavior here is correct.

This also defeats the fix released in 10.2.1 for GHSA-22jq-vg5j-6vgg:
that release classifies IPv4-mapped and NAT64 addresses by their
embedded IPv4 address, but the normalization is reached through
`isInSubnet`, so `::ffff:127.0.0.1/0` reverts to being reported as
non-internal.

##### Impact

Every classifier is affected on both `Address4` and `Address6`. The sole
exception is `Address6.isLinkLocal()` for *native* `fe80::/10`
addresses, which compares raw bits directly; its IPv4-mapped path is
still affected.

| Address | Reported as | Actually points at |
|---|---|---|
| `127.0.0.1/0` | not loopback | loopback (`127.0.0.0/8`) |
| `10.0.0.1/0`, `10.0.0.5/7` | not private | RFC 1918 `10/8` |
| `172.16.5.5/0` | not private | RFC 1918 `172.16/12` |
| `192.168.1.1/0` | not private | RFC 1918 `192.168/16` |
| `169.254.169.254/0` | not link-local | link-local / cloud metadata
(IMDS) |
| `100.64.0.1/0` | not CGNAT | CGNAT `100.64/10` |
| `0.0.0.0/0`, `255.255.255.255/0` | not unspecified / not broadcast |
unspecified / broadcast |
| `::1/0` | not loopback | IPv6 loopback |
| `fc00::1/0` | not ULA, not private | IPv6 ULA `fc00::/7` |
| `ff02::1/0` | not multicast | IPv6 multicast |
| `::ffff:127.0.0.1/0` | not loopback | loopback, via IPv4-mapped |
| `::ffff:169.254.169.254/0` | not link-local | IMDS, via IPv4-mapped |
| `64:ff9b::7f00:1/0` | not loopback | loopback, via NAT64 |

`getType()` returns `Global unicast` for all of the IPv6 cases above,
and `getScope()` follows it.

##### Reachability

A CIDR suffix is not legal in a URL host, so this is not reachable
through the most common SSRF shape. `new URL('http://127.0.0.1/0')`
parses `hostname` as `127.0.0.1` and `pathname` as `/0`, and a guard
that classifies the extracted hostname is unaffected. Exploitation
requires an application that accepts a bare address string that may
carry a suffix and passes it to the constructor before classifying — for
example an allow/deny field, a webhook target, or a proxy destination
taken as a plain host rather than parsed out of a URL.

##### Proof of concept

`npm i ip-address@10.2.1`, then:

```js
const { Address4, Address6 } = require('ip-address');

// true => block as internal, false => allow outbound
function isBlocked(host) {
  try {
    const a = new Address4(host);
    return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()
        || a.isMulticast() || a.isUnspecified() || a.isBroadcast();
  } catch {}
  try {
    const a = new Address6(host);
    return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isULA()
        || a.isMulticast() || a.isUnspecified();
  } catch {}
  return false;
}

for (const h of ['127.0.0.1', '10.0.0.1', '::1',
                 '127.0.0.1/0', '10.0.0.5/7', '169.254.169.254/0',
                 '::1/0', '::ffff:127.0.0.1/0', '64:ff9b::7f00:1/0']) {
  console.log(isBlocked(h) ? 'BLOCK ' : 'ALLOW ', h, '->', new (h.includes(':') ? Address6 : Address4)(h).correctForm());
}
```

On affected versions every suffixed internal target is allowed, and
`correctForm()` shows the request would reach the real internal address:

```
BLOCK  127.0.0.1 -> 127.0.0.1
BLOCK  10.0.0.1 -> 10.0.0.1
BLOCK  ::1 -> ::1
ALLOW  127.0.0.1/0 -> 127.0.0.1
ALLOW  10.0.0.5/7 -> 10.0.0.5
ALLOW  169.254.169.254/0 -> 169.254.169.254
ALLOW  ::1/0 -> ::1
ALLOW  ::ffff:127.0.0.1/0 -> ::ffff:7f00:1
ALLOW  64:ff9b::7f00:1/0 -> 64:ff9b::7f00:1
```

The first three lines are blocked as expected; the same destinations
with a CIDR suffix are allowed through.

##### Remediation

Upgrade to the patched release. In the fix, classification no longer
consults the address's own prefix: a new `isHostInSubnet()` compares the
address's host bits against the reference range only, and every
classifier (`isLoopback`, `isPrivate`, `isLinkLocal`, `isCGNAT`,
`isMulticast`, `isUnspecified`, `isBroadcast`, `isULA`, `isMapped4`,
`isTeredo`, `is6to4`, `isDocumentation`, `getType`, and the
IPv4-mapped/NAT64 normalization behind `embeddedIPv4`) uses it.
`isInSubnet` keeps its subnet-containment semantics unchanged, including
the guard that a wider network is not contained in a narrower one. After
upgrading, `new Address4('127.0.0.1/0').isLoopback()` returns `true`.

If you cannot upgrade immediately, strip the suffix before classifying
by re-parsing `addressMinusSuffix`:

```js
const parsed = new Address4(userInput);
const host = new Address4(parsed.addressMinusSuffix);   // classify this one
```

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

##### Credit

Reported by @&#8203;hi-im-glitchless.

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh)
-
[https://github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d](https://redirect.github.com/beaugunderson/ip-address/commit/488fe9bc7c35363b4b090494fc38c266d217740d)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.2.2](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.2.2)
-
[https://github.com/advisories/GHSA-4xrf-jv44-h6hh](https://redirect.github.com/advisories/GHSA-4xrf-jv44-h6hh)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-4xrf-jv44-h6hh)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### ip-address: Address4 decodes leading-zero octets as decimal while
resolvers decode them as octal, allowing SSRF and trust-boundary bypass
[CVE-2026-69192](https://nvd.nist.gov/vuln/detail/CVE-2026-69192) /
[GHSA-mwp4-54f8-5fhr](https://redirect.github.com/advisories/GHSA-mwp4-54f8-5fhr)

<details>
<summary>More information</summary>

#### Details
##### Summary

`Address4` accepts an octet written with a leading zero and decodes it
as decimal, while the WHATWG URL host parser, `inet_aton`, and
`getaddrinfo` all decode a leading zero as octal. The library and the
network stack therefore disagree about which host a string names. `new
Address4('012.0.0.1')` reports `correctForm()` of `12.0.0.1` and
`isPrivate()` of `false`, but `fetch('http://012.0.0.1/')` connects to
`10.0.0.1`.

An application that builds a network trust-boundary decision on these
checks (for example a filter intended to block Server-Side Request
Forgery, or SSRF) will classify an internal target as external and allow
the request. SSRF is an attack in which a user-supplied address coaxes
the server into making a request to an internal destination the user
could not otherwise reach, such as a loopback service or a cloud
metadata endpoint.

##### Details

`Address4.parse` gates untrusted input on `RE_ADDRESS`
(`src/v4/constants.ts:5`), whose per-octet alternative is:

```
(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)
```

The `[01]?[0-9][0-9]?` branch matches a leading zero, so `012` passes
validation. Every downstream decode then reads the octet with
`parseInt(part, 10)` (`src/common.ts:87`), yielding 12. A resolver
reading the same string treats the leading `0` as base 8 and yields 10.

The defect is in the parse gate rather than in any one classifier, so
every consumer of `Address4` inherits it: `isPrivate()`, `isLoopback()`,
`isLinkLocal()`, `isCGNAT()`, `isInSubnet()`, `isHostInSubnet()`, and
`correctForm()` are all computed from the mis-decoded octets.

`Address6` already rejects this notation on its IPv4-in-IPv6 path,
throwing "IPv4 addresses can't have leading zeroes."
(`src/ipv6.ts:751-762`), so `Address4` is the outlier within the
library.

##### Affected versions

`<= 10.3.0`. Unlike GHSA-22jq-vg5j-6vgg and GHSA-4xrf-jv44-h6hh, which
were bounded below by the `is*` classification API introduced in 10.1.1,
this defect is in `parse` and reaches every release: a guard built on
`isInSubnet()` against the RFC 1918 ranges is affected in versions
predating that API.

##### Impact

The disagreement runs in both directions. Under-blocking is the
security-relevant case; over-blocking is a correctness and availability
problem.

| Input | `correctForm()` | Classified as | Resolver reaches | Effect |
|---|---|---|---|---|
| `012.0.0.1` | `12.0.0.1` | public | `10.0.0.1` | internal target
allowed |
| `012.012.012.012` | `12.12.12.12` | public | `10.10.10.10` | internal
target allowed |
| `010.0.0.1` | `10.0.0.1` | private | `8.0.0.1` | public target blocked
|

Reachable targets are those whose leading octet is expressible as a
three-character octal literal, which covers the whole of `10.0.0.0/8`
and `0.0.0.0/8`. A four-character octet such as `0177` for 127 is
rejected by the regex, so loopback is not reachable through this path;
see the note on rejection below for why rejection is not the same as
safety.

##### Reachability

A leading-zero address is a legal URL host, so this is reachable through
the ordinary URL path with no unusual application shape required:

```js
new URL('http://012.0.0.1/').hostname   // '10.0.0.1'
```

This distinguishes it from GHSA-4xrf-jv44-h6hh, where the `/0` CIDR
suffix could not survive URL parsing and exploitation therefore required
an application that accepted a bare suffix-bearing string. Here the
attack rides the same code path a normal user-supplied URL takes.

##### Proof of concept

`npm i ip-address@10.3.0`, then:

```js
const { Address4 } = require('ip-address');

// A guard of the shape the library documents.
function isBlocked(host) {
  return Address4.isValid(host) && new Address4(host).isPrivate();
}

for (const h of ['10.0.0.1', '012.0.0.1', '012.012.012.012']) {
  console.log(isBlocked(h) ? 'BLOCK' : 'ALLOW', h,
              '-> resolver reaches', new URL('http://' + h + '/').hostname);
}
```

On affected versions:

```
BLOCK 10.0.0.1 -> resolver reaches 10.0.0.1
ALLOW 012.0.0.1 -> resolver reaches 10.0.0.1
ALLOW 012.012.012.012 -> resolver reaches 10.10.10.10
```

The literal RFC 1918 address is blocked as expected; the octal-ambiguous
spellings of the same destinations are allowed through.

##### Remediation

Upgrade to the patched release. In the fix, `Address4.parse` rejects any
octet with a leading zero followed by further digits, mirroring the
check `Address6` already applies at `src/ipv6.ts:751`, and `RE_ADDRESS`
is tightened so those forms no longer appear in the valid corpus. After
upgrading, `Address4.isValid('012.0.0.1')` returns `false` and the
constructor throws `AddressError`.

This rejects input that previous releases accepted. An application that
deliberately feeds zero-padded addresses such as `010.010.010.010` from
a legacy system must strip the padding before parsing.

If you cannot upgrade immediately, reject any host whose octets carry a
leading zero before you parse it:

```js
if (host.split('.').some((octet) => /^0\d/.test(octet))) throw new Error('ambiguous address');
```

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

One specific pitfall is worth naming, because the fix above does not
remove it. `Address4.isValid()` returning `false` means "this is not a
dotted-quad IPv4 literal"; it does not mean "this is not an address that
will reach an internal host". Every one of the following is rejected by
`isValid()` and still resolves to loopback:

```
0177.0.0.1    0x7f.0.0.1    0x7f000001    2130706433
127.1         127.0.1       127.0.0.1.    １２７.0.0.1
```

A guard shaped `if (Address4.isValid(h)) { check() } else {
treatAsHostname() }` therefore routes all of them past the IP check.
Rejecting these is correct behavior for an IPv4 parser and is not
changed by this advisory, but a guard must treat "not a valid literal"
as a case to resolve and re-check, never as a case to allow.

#### Severity
- CVSS Score: 7.7 / 10 (High)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr)
-
[https://github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e](https://redirect.github.com/beaugunderson/ip-address/commit/56368cb3d66c73ba0ee9b6b834fd31b22c2fd71e)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.3.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.3.1)
-
[https://github.com/advisories/GHSA-mwp4-54f8-5fhr](https://redirect.github.com/advisories/GHSA-mwp4-54f8-5fhr)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-mwp4-54f8-5fhr)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>beaugunderson/ip-address (ip-address)</summary>

###
[`v10.3.1`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.3.1)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.3.0...v10.3.1)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.3.0...v10.3.1>

###
[`v10.3.0`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.3.0)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.2.2...v10.3.0)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.2.2...v10.3.0>

###
[`v10.2.2`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.2.2)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.2.1...v10.2.2)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.2.1...v10.2.2>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-04 03:46:46 +00:00
renovate[bot] 68c20028a5 fix(deps): update dependency ip-address to v10.2.1 [security] (#12511) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ip-address](https://redirect.github.com/beaugunderson/ip-address) |
[`10.2.0` →
`10.2.1`](https://renovatebot.com/diffs/npm/ip-address/10.2.0/10.2.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ip-address/10.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ip-address/10.2.0/10.2.1?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses
can bypass SSRF and trust-boundary checks
[CVE-2026-54272](https://nvd.nist.gov/vuln/detail/CVE-2026-54272) /
[GHSA-22jq-vg5j-6vgg](https://redirect.github.com/advisories/GHSA-22jq-vg5j-6vgg)

<details>
<summary>More information</summary>

#### Details
##### Summary

`Address6`'s special-property checks misclassify IPv4-mapped
(`::ffff:0:0/96`) and NAT64 well-known (`64:ff9b::/96`) IPv6 addresses.
These checks classify an address by its IPv6 wrapper rather than by the
IPv4 address it embeds, so `isLoopback()`, `isLinkLocal()`,
`isMulticast()`, and `isUnspecified()` all return `false` for literals
such as `::ffff:127.0.0.1` or `::ffff:169.254.169.254` that actually
route to loopback, RFC 1918, or link-local (cloud-metadata)
destinations. `Address6` also had no `isPrivate()` method, so a mapped
RFC 1918 address could not be detected at all.

An application that builds a network trust-boundary decision on these
checks (for example, a filter intended to block Server-Side Request
Forgery, or SSRF) may therefore treat an internal target as external and
allow the request. SSRF is an attack in which a user-supplied address
coaxes the server into making a request to an internal destination the
user could not otherwise reach, such as a loopback service or a cloud
metadata endpoint.

##### Details

`Address6.getType()` classifies an address by matching it against a
table of known IPv6 special-use prefixes, returning `Global unicast`
when nothing matches. That table had no entry for the IPv4-mapped range
(`::ffff:0:0/96`), so every mapped address fell through to `Global
unicast`; NAT64 addresses matched their own `NAT64 …` labels. The
boolean checks `isLoopback`, `isUnspecified`, and `isMulticast` compared
`getType()` against a fixed label and so returned `false`, while
`isLinkLocal` and `isULA` checked only the native IPv6 ranges.

The library already exposed `isMapped4()` and `to4()`, but did not apply
them inside these checks, so a mapped or NAT64 address was never
normalized to its embedded IPv4 address before classification. The
underlying CIDR matching is correct; the defect is that the special-use
table omitted the IPv4-mapped range and the checks performed no
embedded-IPv4 normalization.

##### Affected versions

`>= 10.1.1, <= 10.2.0`. The `is*` classification API was introduced for
`Address4` in 10.1.1 and extended to `Address6` in 10.2.0. Releases
before 10.1.1 do not expose this API and are not affected through this
vector.

##### Impact

The misclassification covers the entire `::ffff:0:0/96` range, in both
dotted and hex notation and case-insensitively, plus the `64:ff9b::/96`
NAT64 well-known prefix:

| Address | Reported as | Actually points at |
|---|---|---|
| `::ffff:127.0.0.1` / `::ffff:7f00:1` | Global unicast | loopback
(`127.0.0.0/8`) |
| `::ffff:10.0.0.1` | Global unicast | RFC 1918 `10/8` |
| `::ffff:172.16.5.5` | Global unicast | RFC 1918 `172.16/12` |
| `::ffff:192.168.1.1` | Global unicast | RFC 1918 `192.168/16` |
| `::ffff:169.254.169.254` / `::ffff:a9fe:a9fe` | Global unicast |
link-local / cloud metadata (IMDS) |
| `::ffff:100.64.0.1` | Global unicast | CGNAT `100.64/10` |
| `::ffff:0.0.0.0` / `::ffff:255.255.255.255` | Global unicast |
unspecified / broadcast |
| `64:ff9b::7f00:1` / `64:ff9b::a9fe:a9fe` | NAT64 (well-known) |
loopback / IMDS via NAT64 |

For IPv4-mapped addresses the host OS routes to the IPv4 stack, so the
misclassification is reachable on any dual-stack host. For NAT64, the
classification bypass is unconditional but end-to-end reachability
additionally requires a NAT64/DNS64 gateway in the deployment network.

##### Proof of concept

A guard assembled from these checks lets internal hosts through:

```js
const { Address4, Address6 } = require('ip-address');

// true => block as internal, false => allow outbound
function isBlocked(host) {
  try {
    const a = new Address4(host);
    return a.isPrivate() || a.isLoopback() || a.isLinkLocal() || a.isCGNAT()
        || a.isMulticast() || a.isUnspecified() || a.isBroadcast();
  } catch {}
  try {
    const a = new Address6(host);
    return a.isLoopback() || a.isLinkLocal() || a.isULA()
        || a.isMulticast() || a.isUnspecified();
  } catch {}
  return false;
}

for (const h of ['127.0.0.1', '::1', '10.0.0.1', '8.8.8.8',
                 '::ffff:127.0.0.1', '::ffff:10.0.0.1',
                 '::ffff:169.254.169.254', '64:ff9b::7f00:1']) {
  console.log(isBlocked(h) ? 'BLOCK ' : 'ALLOW ', h);
}
```

On affected versions this prints (note that every `::ffff:…` and
`64:ff9b::…` internal target is allowed):

```
BLOCK  127.0.0.1
BLOCK  ::1
BLOCK  10.0.0.1
ALLOW  8.8.8.8
ALLOW  ::ffff:127.0.0.1
ALLOW  ::ffff:10.0.0.1
ALLOW  ::ffff:169.254.169.254
ALLOW  64:ff9b::7f00:1
```

The first three lines (native loopback, native IPv6 loopback, and a
literal RFC 1918 address) are blocked as expected; the IPv4-mapped and
NAT64 forms of the same internal destinations are allowed through.

##### Remediation

Upgrade to the patched release. In the fix, `Address6` normalizes
IPv4-mapped and NAT64 well-known addresses to their embedded IPv4
address before classifying, via a new `embeddedIPv4()` helper that
`isLoopback`, `isLinkLocal`, `isMulticast`, and `isUnspecified` consult
first. `Address6` also gains `isPrivate()`, `isCGNAT()`, and
`isBroadcast()` for parity with `Address4`, and `getType()` now labels
the `::ffff:0:0/96` range as `IPv4-mapped`. After upgrading, `new
Address6('::ffff:127.0.0.1').isLoopback()` returns `true` and `new
Address6('::ffff:10.0.0.1').isPrivate()` returns `true`.

If you cannot upgrade immediately, normalize embedded IPv4 addresses
yourself before classifying: call `to4()` on any address where
`isMapped4()` (or membership in `64:ff9b::/96`) is true, and run your
IPv4 checks against the result.

##### A note on SSRF defense

These methods are address classifiers, not a complete SSRF defense.
Regardless of this fix, a robust SSRF guard must resolve the hostname
and validate the *resolved* IP against the socket it connects to, and
account for DNS rebinding and redirects. Treat these checks as one
layer, not the only one.

##### Credit

Reported by @&#8203;OV-0-VO.

#### Severity
- CVSS Score: 6.9 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N`

#### References
-
[https://github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg](https://redirect.github.com/beaugunderson/ip-address/security/advisories/GHSA-22jq-vg5j-6vgg)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-54272](https://nvd.nist.gov/vuln/detail/CVE-2026-54272)
-
[https://github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef9](https://redirect.github.com/beaugunderson/ip-address/commit/4a1f613f4c1bec915677dea923c10aaa09361ef9)
-
[https://github.com/beaugunderson/ip-address/releases/tag/v10.2.1](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.2.1)
-
[https://github.com/advisories/GHSA-22jq-vg5j-6vgg](https://redirect.github.com/advisories/GHSA-22jq-vg5j-6vgg)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-22jq-vg5j-6vgg)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>beaugunderson/ip-address (ip-address)</summary>

###
[`v10.2.1`](https://redirect.github.com/beaugunderson/ip-address/releases/tag/v10.2.1)

[Compare
Source](https://redirect.github.com/beaugunderson/ip-address/compare/v10.2.0...v10.2.1)

**Full Changelog**:
<https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.2.1>

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyJdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-08-04 03:35:29 +00:00
renovate[bot] d06830bdae chore(deps): update dependency @types/node to v22.20.1 (#12491) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.20.0` →
`22.20.1`](https://renovatebot.com/diffs/npm/@types%2fnode/22.20.0/22.20.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.20.0/22.20.1?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNzUuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI3NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-24 08:58:29 +00:00
Gastón Fournier a153aca813 fix: resolve Dependabot npm vulnerabilities 
## Summary
- Updates vulnerable npm dependencies reported by Dependabot across the
root and standalone OSS pnpm lockfiles.
- Adds focused pnpm overrides for vulnerable transitive packages where
parent upgrades do not naturally lift the resolved version.
- Updates the direct `js-yaml` dependency and enterprise override to
`4.3.0`.
- Keeps release-age quarantine exceptions limited to the security patch
versions that are still within the 7-day window after a supply-chain
review.

## Security updates
This resolves vulnerable resolved versions for packages including
`axios`, `body-parser`, `brace-expansion`, `fast-uri`, `hono`,
`@hono/node-server`, `@opentelemetry/propagator-jaeger`, `immutable`,
`js-yaml`, `linkify-it`, `protobufjs`, `shell-quote`, and
`systeminformation`.

## Supply-chain review
- Removed release-age exceptions for packages already older than the
workspace quarantine window.
- Kept only `@hono/node-server@2.0.10` and `fast-uri@3.1.4` as temporary
release-age exceptions.
- Checked npm registry metadata for the exception versions: package
integrity/signatures are present, maintainer and repository lineage are
consistent, and dry-run tarball inspection showed no install hooks,
bins, or bundled dependencies.
- `@hono/node-server@2.0.10` has npm provenance attestation;
`fast-uri@3.1.4` does not, so it should be removed from the exception
list once it ages out.
 2026-07-22 14:02:26 +00:00
Christopher Kolstad 6152518dbc chore: upgrade to Typescript 7 2026-07-20 14:46:00 +02:00
Github Actions Bot ebb398aeee 8.0.3 2026-07-10 09:32:36 +00:00
renovate[bot] c4b004dede chore(deps): update dependency tsc-watch to v7.2.1 (#12472) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [tsc-watch](https://redirect.github.com/gilamran/tsc-watch) | [`7.2.0`
→ `7.2.1`](https://renovatebot.com/diffs/npm/tsc-watch/7.2.0/7.2.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/tsc-watch/7.2.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/tsc-watch/7.2.0/7.2.1?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>gilamran/tsc-watch (tsc-watch)</summary>

###
[`v7.2.1`](https://redirect.github.com/gilamran/tsc-watch/blob/HEAD/CHANGELOG.md#v721---28062026)

[Compare
Source](https://redirect.github.com/gilamran/tsc-watch/compare/v7.2.0...v7.2.1)

- support for node Typescript 7+
- fix: Fixed issue with `--maxNodeMem` argument.
- fix: Fixed issue with killing the process on SIGTERM signal.
- fix: Fixed failing test

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-08 18:22:39 +00:00
Gastón Fournier 7e38dd786f chore: tidy package lifecycle scripts 2026-07-08 15:13:53 +02:00
renovate[bot] 7f4cca79cb chore(deps): update node.js to 22.23 (#12462) 
This PR contains the following updates:

| Package | Type | Update | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|---|---|
| [node](https://nodejs.org)
([source](https://redirect.github.com/nodejs/node)) | | minor | `22.22`
→ `22.23` |
![age](https://developer.mend.io/api/mc/badges/age/node-version/node/v22.23.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/node-version/node/v22.22.3/v22.23.1?slim=true)
|
| [node](https://redirect.github.com/nodejs/node) | final | minor |
`22.22-alpine3.23` → `22.23-alpine3.23` |
![age](https://developer.mend.io/api/mc/badges/age/docker/node/22.23.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/node/22.22.3/22.23.1?slim=true)
|
| [node](https://redirect.github.com/nodejs/node) | stage | minor |
`22.22-alpine3.23` → `22.23-alpine3.23` |
![age](https://developer.mend.io/api/mc/badges/age/docker/node/22.23.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/node/22.22.3/22.23.1?slim=true)
|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| devDependencies | minor | [`22.19.21` →
`22.20.0`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.21/22.20.0)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.20.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.19.21/22.20.0?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>nodejs/node (node)</summary>

###
[`v22.23.1`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.1):
2026-06-23, Version 22.23.1 'Jod' (LTS), @&#8203;RafaelGSS

[Compare
Source](https://redirect.github.com/nodejs/node/compare/v22.23.0...v22.23.1)

This release includes a fix for an unexpected behavior introduced
by the recent security release (22.23.0).

##### Commits

-
\[[`41d2ee13be`](https://redirect.github.com/nodejs/node/commit/41d2ee13be)]
- **build**: switch coverage-windows to `windows-2022` (Richard Lau)
[#&#8203;63940](https://redirect.github.com/nodejs/node/pull/63940)
-
\[[`eaa292549e`](https://redirect.github.com/nodejs/node/commit/eaa292549e)]
- **http**: avoid stream listeners on idle agent sockets (Matteo
Collina)
[#&#8203;64004](https://redirect.github.com/nodejs/node/pull/64004)

###
[`v22.23.0`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.0):
2026-06-18, Version 22.23.0 'Jod' (LTS), @&#8203;aduh95

[Compare
Source](https://redirect.github.com/nodejs/node/compare/v22.22.3...v22.23.0)

This is a security release.

##### Notable Changes

- (CVE-2026-48618) tls: normalize hostname for server identity checks
(Matteo Collina) – High
- (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip
Skokan) – High
- (CVE-2026-48937) deps: fix integration issues with the latest nghttp2
– Medium
- (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes
(Matteo Collina) – Medium
- (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory
growth (Matteo Collina) – Medium
- (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors
(Matteo Collina) – Medium
- (CVE-2026-48934) tls: bind reusable sessions to authenticated host
(Matteo Collina) – Medium
- (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo
Collina) – Medium
- (CVE-2026-48617) permission: handle process.chdir on writereport
(RafaelGSS) – Low
- (CVE-2026-48931) http: fix response queue poisoning in http.Agent
(Matteo Collina) – Low
- (CVE-2026-48935) permission: disable FileHandle utimes with permission
model (RafaelGSS) – Low

##### Commits

-
\[[`38b4c5ed51`](https://redirect.github.com/nodejs/node/commit/38b4c5ed51)]
- **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length
(Filip Skokan)
[nodejs-private/node-private#878](https://redirect.github.com/nodejs-private/node-private/pull/878)
-
\[[`ad8a10c1bb`](https://redirect.github.com/nodejs/node/commit/ad8a10c1bb)]
- **deps**: update llhttp to 9.4.2 (Antoine du Hamel)
[nodejs-private/node-private#890](https://redirect.github.com/nodejs-private/node-private/pull/890)
-
\[[`ca825a87cc`](https://redirect.github.com/nodejs/node/commit/ca825a87cc)]
- **deps**: update undici to 6.27.0 (aduh95)
[#&#8203;63711](https://redirect.github.com/nodejs/node/pull/63711)
-
\[[`a1a5bb9683`](https://redirect.github.com/nodejs/node/commit/a1a5bb9683)]
- **(CVE-2026-48937)** **deps**: fix integration issues with the latest
nghttp2 (Tim Perry)
[#&#8203;62891](https://redirect.github.com/nodejs/node/pull/62891)
-
\[[`0f48583512`](https://redirect.github.com/nodejs/node/commit/0f48583512)]
- **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub
Bot) [#&#8203;62891](https://redirect.github.com/nodejs/node/pull/62891)
-
\[[`38c869fc05`](https://redirect.github.com/nodejs/node/commit/38c869fc05)]
- **deps**: update nghttp2 to 1.68.0 (nodejs-github-bot)
[#&#8203;61136](https://redirect.github.com/nodejs/node/pull/61136)
-
\[[`290667c84f`](https://redirect.github.com/nodejs/node/commit/290667c84f)]
- **deps**: update nghttp2 to 1.67.1 (nodejs-github-bot)
[#&#8203;59790](https://redirect.github.com/nodejs/node/pull/59790)
-
\[[`c9f3da76aa`](https://redirect.github.com/nodejs/node/commit/c9f3da76aa)]
- **deps**: update nghttp2 to 1.66.0 (Node.js GitHub Bot)
[#&#8203;58786](https://redirect.github.com/nodejs/node/pull/58786)
-
\[[`60890be563`](https://redirect.github.com/nodejs/node/commit/60890be563)]
- **deps**: update nghttp2 to 1.65.0 (Node.js GitHub Bot)
[#&#8203;57269](https://redirect.github.com/nodejs/node/pull/57269)
-
\[[`5024c7d5d8`](https://redirect.github.com/nodejs/node/commit/5024c7d5d8)]
- **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot)
[#&#8203;63820](https://redirect.github.com/nodejs/node/pull/63820)
-
\[[`7f4eb5af2e`](https://redirect.github.com/nodejs/node/commit/7f4eb5af2e)]
- **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub
Bot) [#&#8203;63820](https://redirect.github.com/nodejs/node/pull/63820)
-
\[[`ebb4ec78a8`](https://redirect.github.com/nodejs/node/commit/ebb4ec78a8)]
- **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse)
[#&#8203;62656](https://redirect.github.com/nodejs/node/pull/62656)
-
\[[`5763d40826`](https://redirect.github.com/nodejs/node/commit/5763d40826)]
- **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot)
[#&#8203;63045](https://redirect.github.com/nodejs/node/pull/63045)
-
\[[`c551a51d0c`](https://redirect.github.com/nodejs/node/commit/c551a51d0c)]
- **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL
bytes (Matteo Collina)
[nodejs-private/node-private#868](https://redirect.github.com/nodejs-private/node-private/pull/868)
-
\[[`0a22d40180`](https://redirect.github.com/nodejs/node/commit/0a22d40180)]
- **(CVE-2026-48931)** **http**: fix response queue poisoning in
http.Agent (Matteo Collina)
[nodejs-private/node-private#846](https://redirect.github.com/nodejs-private/node-private/pull/846)
-
\[[`c79968e108`](https://redirect.github.com/nodejs/node/commit/c79968e108)]
- **(CVE-2026-48619)** **http2**: cap originSet size to prevent
unbounded memory growth (Matteo Collina)
[nodejs-private/node-private#855](https://redirect.github.com/nodejs-private/node-private/pull/855)
-
\[[`0c37bff2ff`](https://redirect.github.com/nodejs/node/commit/0c37bff2ff)]
- **http2**: fix DEP0194 message (KaKa)
[#&#8203;58669](https://redirect.github.com/nodejs/node/pull/58669)
-
\[[`ea5dc6b529`](https://redirect.github.com/nodejs/node/commit/ea5dc6b529)]
- **(SEMVER-MAJOR)** **http2**: remove support for priority signaling
(Matteo Collina)
[#&#8203;58293](https://redirect.github.com/nodejs/node/pull/58293)
-
\[[`9b6af26132`](https://redirect.github.com/nodejs/node/commit/9b6af26132)]
- **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel
errors (Matteo Collina)
[nodejs-private/node-private#867](https://redirect.github.com/nodejs-private/node-private/pull/867)
-
\[[`28dcd38864`](https://redirect.github.com/nodejs/node/commit/28dcd38864)]
- **(CVE-2026-48935)** **permission**: disable FileHandle utimes with
permission model (RafaelGSS)
[nodejs-private/node-private#873](https://redirect.github.com/nodejs-private/node-private/pull/873)
-
\[[`2f62693801`](https://redirect.github.com/nodejs/node/commit/2f62693801)]
- **(CVE-2026-48617)** **permission**: handle process.chdir on
writereport (RafaelGSS)
[nodejs-private/node-private#870](https://redirect.github.com/nodejs-private/node-private/pull/870)
-
\[[`1662a3ea09`](https://redirect.github.com/nodejs/node/commit/1662a3ea09)]
- **test**: add session reuse host verification regressions (Matteo
Collina)
[nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854)
-
\[[`718d5d0e2c`](https://redirect.github.com/nodejs/node/commit/718d5d0e2c)]
- **test**: skip `test-fs-utimes-y2K38` on armv7 (Richard Lau)
[#&#8203;63836](https://redirect.github.com/nodejs/node/pull/63836)
-
\[[`041185b61f`](https://redirect.github.com/nodejs/node/commit/041185b61f)]
- **test**: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison)
[#&#8203;62238](https://redirect.github.com/nodejs/node/pull/62238)
-
\[[`fd890ba01d`](https://redirect.github.com/nodejs/node/commit/fd890ba01d)]
- **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated
host (Matteo Collina)
[nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854)
-
\[[`39d1d09684`](https://redirect.github.com/nodejs/node/commit/39d1d09684)]
- **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching
(Matteo Collina)
[nodejs-private/node-private#857](https://redirect.github.com/nodejs-private/node-private/pull/857)
-
\[[`2197a47144`](https://redirect.github.com/nodejs/node/commit/2197a47144)]
- **(CVE-2026-48618)** **tls**: normalize hostname for server identity
checks (Matteo Collina)
[nodejs-private/node-private#869](https://redirect.github.com/nodejs-private/node-private/pull/869)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-07-03 02:37:54 +00:00
Github Actions Bot 8ee9e914ce 8.0.2 2026-06-29 09:33:03 +00:00
Krzysztof (Kris) Kula b9f3217d32 chore: bump unleash-client to 6.11.1 (#12429) 
## About the changes

upgrade to
https://github.com/Unleash/unleash-node-sdk/releases/tag/v6.11.1

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.
 2026-06-29 08:50:25 +01:00
dependabot[bot] caf765d358 chore(deps): bump nodemailer from 8.0.11 to 9.0.1 (#12358) 2026-06-26 18:06:19 +02:00
renovate[bot] dc5a9f2c85 chore(deps): update vitest monorepo to v4.1.9 (#12388) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@vitest/coverage-v8](https://vitest.dev/guide/coverage)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8))
| [`4.1.8` →
`4.1.9`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.8/4.1.9)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.8/4.1.9?slim=true)
|
| [@vitest/ui](https://vitest.dev/guide/ui)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/ui))
| [`4.1.8` →
`4.1.9`](https://renovatebot.com/diffs/npm/@vitest%2fui/4.1.8/4.1.9) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fui/4.1.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fui/4.1.8/4.1.9?slim=true)
|
| [vitest](https://vitest.dev)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
| [`4.1.8` →
`4.1.9`](https://renovatebot.com/diffs/npm/vitest/4.1.8/4.1.9) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.9?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.8/4.1.9?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>vitest-dev/vitest (@&#8203;vitest/coverage-v8)</summary>

###
[`v4.1.9`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.9)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9)

##### 🐞 Bug Fixes

- Fix `importOriginal` with optimizer and query import \[backport to v4]
- by **Hiroshi Ogawa**, **David Harris**, **Codex**and **Vladimir** in
[#&#8203;10546](https://redirect.github.com/vitest-dev/vitest/issues/10546)
[<samp>(a5180)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/a5180190c)
- **browser**:
- Wait for orchestrator readiness before resolving browser sessions
\[backport to v4] - by **Vladimir** and **Séamus O'Connor** in
[#&#8203;10555](https://redirect.github.com/vitest-dev/vitest/issues/10555)
[<samp>(7fb29)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/7fb29651a)
- Wait for iframe tester readiness before preparing \[backport to v4] -
by **Vladimir** and **Séamus O'Connor** in
[#&#8203;10497](https://redirect.github.com/vitest-dev/vitest/issues/10497)
and
[#&#8203;10556](https://redirect.github.com/vitest-dev/vitest/issues/10556)
[<samp>(fbc62)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/fbc626c40)
- **mocker**:
- Hoist vi.mock() for vite-plus/test imports \[backport to v4] - by
**Hiroshi Ogawa**, **LongYinan**, **Claude Opus 4.8** and **Vladimir**
in
[#&#8203;10548](https://redirect.github.com/vitest-dev/vitest/issues/10548)
[<samp>(2c955)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/2c9559c02)
- **pool**:
- Prevent test run hang on worker crash \[backport to v4] - by **Ari
Perkkiö** and **Jattioui Ismail** in
[#&#8203;10543](https://redirect.github.com/vitest-dev/vitest/issues/10543)
and
[#&#8203;10564](https://redirect.github.com/vitest-dev/vitest/issues/10564)
[<samp>(934b0)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/934b0f587)

##### [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9)

</details>

<details>
<summary>vitest-dev/vitest (@&#8203;vitest/ui)</summary>

###
[`v4.1.9`](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzUuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIzNS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-22 19:48:44 +00:00
Christopher Kolstad 146efc059e feat: added htmlInput validation extension for joi schemas (#12377) 
## About the changes

Adds an extension to reject input that contains html tags. Also starts
using it for project name.
### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.

---------

Co-authored-by: Thomas Heartman <thomas@getunleash.io>
 2026-06-22 14:02:23 +02:00
Christopher Kolstad 074666d104 task: update pnpm to 11.8.0 (#12373) 
## About the changes

What the title says, updates pnpm to 11.8.0

### Important files

## Discussion points

## OSS PR checklist

- [x] I have read and agree to the [Unleash Contributor License
Agreement](https://github.com/Unleash/unleash/blob/main/CLA.md).
- [x] I have added tests or explained why tests are not needed.
- [x] I have updated documentation where relevant.
 2026-06-22 10:12:21 +02:00
renovate[bot] 6630b659c8 chore(deps): update pnpm to v11.5.3 (#12348) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.5.2+sha512.71c631e382066efc25625d5cf029075de07b61b37f6e27350fbd84b1bda5864c8c1967adc280776b45c30a715c0359a3be08fef42d5bb09e2b99029979692916`
→ `11.5.3`](https://renovatebot.com/diffs/npm/pnpm/11.5.2/11.5.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.5.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.5.2/11.5.3?slim=true)
|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.5.2` →
`11.5.3`](https://renovatebot.com/diffs/npm/pnpm/11.5.2/11.5.3) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.5.3?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.5.2/11.5.3?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.5.3`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1153)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.2...v11.5.3)

##### Patch Changes

- Stopped expanding environment variables in repository-controlled
registry/proxy request destinations and registry credential values from
`.npmrc`, and in workspace registry URLs from `pnpm-workspace.yaml`.
Move dynamic registry URL and token configuration to trusted user,
global, CLI, or environment config.

- Resolve package-manager bootstrap dependencies with trusted user or
CLI registry and network config, and reject package-manager env-lockfile
records that do not use registry package paths with integrity-only
resolutions before auto-switch execution.

- Avoid writing `packageManagerDependencies` to `pnpm-lock.yaml` when
package manager policy is set to `onFail: ignore` or `pmOnFail: ignore`
[#&#8203;12228](https://redirect.github.com/pnpm/pnpm/issues/12228).

- Avoid running dependency-status auto-install when the dependency
status is unavailable without a project manifest.

- Using the `$` version reference syntax in `overrides` (e.g. `"react":
"$react"`) now prints a deprecation warning. The syntax still works, but
[catalogs](https://pnpm.io/catalogs) are the recommended way to keep an
overridden version in sync with the rest of the workspace. Reference a
catalog entry with the `catalog:` protocol instead.

- Fixed `pnpm config get globalconfig` to return the global
`config.yaml` path again
[pnpm/pnpm#11962](https://redirect.github.com/pnpm/pnpm/issues/11962).

- Fixed bare `--color` so it does not consume the following CLI flag,
allowing command shorthands like `--parallel` to expand correctly and
forms like `pnpm --color with current <command>` to dispatch the inner
command instead of failing with `MISSING_WITH_CURRENT_CMD`.

- Fix `pnpm install` ignoring `enableGlobalVirtualStore` toggle by
including it in the workspace state settings check
[#&#8203;12142](https://redirect.github.com/pnpm/pnpm/issues/12142).

- Security: pnpm now verifies the npm registry signature of a
package-manager binary before spawning it, so a cloned repository cannot
make pnpm download and execute an arbitrary native binary.

This covers two paths that select an executable from
repository-controlled input:

- **pacquet install engine** — declaring `pacquet` (or `@pnpm/pacquet`)
in `configDependencies` opts in to pnpm's Rust install engine. pnpm now
verifies that the installed `pacquet` shim and the host's
`@pacquet/<platform>-<arch>` binary carry a valid npm registry signature
for their exact `name@version`, and refuses to run pacquet (failing the
command) if the signature does not verify or cannot be checked. The only
graceful fallback to pnpm's own engine is when pacquet has no binary for
the current platform.
- **automatic version switch / `self-update`** — the `packageManager` /
`devEngines.packageManager` field makes pnpm download and run a specific
pnpm version. pnpm now verifies the registry signature of `pnpm`,
`@pnpm/exe`, and the host platform binary before installing/spawning
them, and refuses to run an engine whose signature does not match a
published, signed release. The check runs only on an actual download
(store cache miss), so it does not add a network round trip to every
command.

In both cases the signature is verified over the *installed* integrity,
against npm's public signing keys that ship embedded in the pnpm CLI
(like corepack), so bytes substituted via a tampered lockfile or a
repository-controlled registry fail verification — and a registry the
user did not vouch for cannot supply its own signing keys. The signed
packument is fetched from the configured registry, so an npm mirror
works transparently. Verification fails closed: if it cannot be
completed (for example, the registry is unreachable), the command fails
rather than running an unverified binary. The embedded keys are kept
current by a release-time check against npm's signing-keys endpoint.

- Made peer-dependent deduplication deterministic. When a peer-suffixed
package variant was a subset of two or more mutually incompatible larger
variants, the variant it collapsed into depended on the order importers
were resolved in, which varies between machines. This could resolve the
same workspace to different lockfiles on different platforms and make
`pnpm dedupe --check` alternate between passing and failing.

- Reject invalid package names and versions from staged tarball
manifests before deriving filenames for `pnpm stage download`.

- Clarified in CLI help that the pnpm store is trusted shared state and
store integrity checks are corruption detection, not a tamper boundary
for untrusted store writers.

- Reject reserved manifest `bin` names (`""`, `"."`, `".."`, and scoped
forms such as `@scope/..`) when resolving a package's bins. These names
previously passed the bin-name guard and, when joined to the global bin
directory during global remove/update/add operations, could resolve to
the global bin directory itself or its parent and have it recursively
deleted.

- Require trusted package identity before package-name `allowBuilds`
entries can approve lifecycle scripts for git, git-hosted tarball,
direct tarball, and local directory artifacts. To approve one of those
artifacts explicitly, use its peer-suffix-free lockfile depPath as the
`allowBuilds` key. Lockfile verification now rejects lockfiles where a
registry-style dependency path (`name@semver`) is backed by a git,
directory, or git-hosted tarball resolution
(`ERR_PNPM_RESOLUTION_SHAPE_MISMATCH`), so the dependency path is a
reliable artifact identity by the time scripts can run.

- Security: pnpm now verifies the OpenPGP signature of a downloaded
Node.js runtime's `SHASUMS256.txt` before trusting its integrity hashes.

When a repository requests a Node.js runtime (e.g. via
`devEngines.runtime` / `useNodeVersion`), the download mirror is
repository-configurable through `node-mirror:<channel>`. The integrity
of the downloaded binary was only checked against `SHASUMS256.txt`
fetched from that same mirror — a circular check that a malicious mirror
could satisfy by serving a tampered binary together with a matching
`SHASUMS256.txt`. pnpm then executes the binary (for example to run
lifecycle scripts).

pnpm now fetches `SHASUMS256.txt.sig` and verifies the detached OpenPGP
signature against the Node.js release team's public keys, which ship
embedded in the pnpm CLI. A mirror that serves a tampered binary cannot
also produce a valid signature, so the download fails to verify. The
embedded keys are kept current by a release-time check against the
canonical `nodejs/release-keys` list.

The musl variants from the hardcoded `unofficial-builds.nodejs.org`
mirror are not repository-configurable and are signed by a different
key, so they continue to be trusted over TLS.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 07:17:17 +00:00
renovate[bot] 35c424d0cc chore(deps): update dependency @types/node to v22.19.21 (#12347) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.19.20` →
`22.19.21`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.20/22.19.21)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.19.21?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.19.20/22.19.21?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-18 02:55:41 +00:00
renovate[bot] 82be2c63e1 chore(deps): update dependency fast-check to v4.8.0 (#12336) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-check](https://fast-check.dev/)
([source](https://redirect.github.com/dubzzz/fast-check/tree/HEAD/packages/fast-check))
| [`4.7.0` →
`4.8.0`](https://renovatebot.com/diffs/npm/fast-check/4.7.0/4.8.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fast-check/4.8.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-check/4.7.0/4.8.0?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>dubzzz/fast-check (fast-check)</summary>

###
[`v4.8.0`](https://redirect.github.com/dubzzz/fast-check/blob/HEAD/packages/fast-check/CHANGELOG.md#480)

[Compare
Source](https://redirect.github.com/dubzzz/fast-check/compare/v4.7.0...v4.8.0)

*New arbitrary to chain in a loop fashion*

\[[Code](https://redirect.github.com/dubzzz/fast-check/tree/v4.8.0)]\[[Diff](https://redirect.github.com/dubzzz/fast-check/compare/v4.7.0...v4.8.0)]

#### Features

- ([PR#6678](https://redirect.github.com/dubzzz/fast-check/pull/6678))
Add `chainUntil` arbitrary for iterative chaining

#### Fixes

- ([PR#6965](https://redirect.github.com/dubzzz/fast-check/pull/6965))
Bug: Restore ability not to use `skipLibCheck`
- ([PR#6877](https://redirect.github.com/dubzzz/fast-check/pull/6877))
CI: Lowercase discussion\_category\_name to "announcements"
- ([PR#6878](https://redirect.github.com/dubzzz/fast-check/pull/6878))
CI: Scope permissions of clean-caches
- ([PR#6880](https://redirect.github.com/dubzzz/fast-check/pull/6880))
CI: Add PR-authoring guidance for Claude
- ([PR#6887](https://redirect.github.com/dubzzz/fast-check/pull/6887))
CI: Delete CLAUDE.md
- ([PR#6888](https://redirect.github.com/dubzzz/fast-check/pull/6888))
CI: Use tilde ranges for security dependency overrides
- ([PR#6891](https://redirect.github.com/dubzzz/fast-check/pull/6891))
CI: Disable Renovate updates on pnpm overrides
- ([PR#6899](https://redirect.github.com/dubzzz/fast-check/pull/6899))
CI: Scope Claude hooks to `$CLAUDE_PROJECT_DIR`
- ([PR#6905](https://redirect.github.com/dubzzz/fast-check/pull/6905))
CI: Enable pnpm global virtual store
- ([PR#6933](https://redirect.github.com/dubzzz/fast-check/pull/6933))
CI: Pin pnpm in npm install commands
- ([PR#6932](https://redirect.github.com/dubzzz/fast-check/pull/6932))
CI: Grant `discussions: write` to release jobs
- ([PR#6935](https://redirect.github.com/dubzzz/fast-check/pull/6935))
CI: Skip PR template check for dubzzz
- ([PR#6937](https://redirect.github.com/dubzzz/fast-check/pull/6937))
CI: Mirror the repo to tangled
- ([PR#6938](https://redirect.github.com/dubzzz/fast-check/pull/6938))
CI: Add missing runs-on for tangled
- ([PR#6889](https://redirect.github.com/dubzzz/fast-check/pull/6889))
Doc: Add release notes for fast-check 4.7.0
- ([PR#6900](https://redirect.github.com/dubzzz/fast-check/pull/6900))
Doc: Fix broken API reference links
- ([PR#6844](https://redirect.github.com/dubzzz/fast-check/pull/6844))
Doc: Extract manual setup guide into dedicated page
- ([PR#6845](https://redirect.github.com/dubzzz/fast-check/pull/6845))
Doc: Add index pages for documentation sections
- ([PR#6918](https://redirect.github.com/dubzzz/fast-check/pull/6918))
Doc: Fix Documentation link to point to first doc page
- ([PR#6939](https://redirect.github.com/dubzzz/fast-check/pull/6939))
Doc: Link to Tangled mirror of fast-check
- ([PR#6934](https://redirect.github.com/dubzzz/fast-check/pull/6934))
Test: Tolerate `\p{...}` value drift in docs tests
- ([PR#6951](https://redirect.github.com/dubzzz/fast-check/pull/6951))
Test: Fix poisoning tests for latest Node

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-17 02:43:45 +00:00
Github Actions Bot f6125bdb43 8.0.1 2026-06-16 14:02:12 +00:00
renovate[bot] a3dec2e65a chore(deps): update pnpm to v11.5.2 (#12304) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [pnpm](https://pnpm.io)
([source](https://redirect.github.com/pnpm/pnpm/tree/HEAD/pnpm)) |
[`11.5.1+sha512.93f7b57422ea7068257235b4c16eb60762eb68e1dc23723199cc739043ea9be2c4143274a399d8c6defa2b1176226d9ca1c4b63482d6200c1a8fbaa78c1d1485`
→ `11.5.2`](https://renovatebot.com/diffs/npm/pnpm/11.5.1/11.5.2) |
![age](https://developer.mend.io/api/mc/badges/age/npm/pnpm/11.5.2?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/pnpm/11.5.1/11.5.2?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Release Notes

<details>
<summary>pnpm/pnpm (pnpm)</summary>

###
[`v11.5.2`](https://redirect.github.com/pnpm/pnpm/blob/HEAD/pnpm/CHANGELOG.md#1152)

[Compare
Source](https://redirect.github.com/pnpm/pnpm/compare/v11.5.1...v11.5.2)

##### Patch Changes

- Peer dependency resolution now reuses the peer contexts already
recorded in the lockfile when those providers are still present in the
dependency graph and still satisfy the peer ranges. This avoids
unnecessary peer-context rewrites during lockfile regeneration. Current
manifest choices remain authoritative: a newly added, explicitly
updated, or aliased direct provider, a changed nested provider, or a
locked version that no longer satisfies the range still takes
precedence.

- The lockfile verifier now checks that a registry entry pinning an
explicit `tarball` URL points at the artifact the registry's own
metadata lists for that `name@version`. Previously a tampered lockfile
could pair a trusted `name@version` with an attacker-chosen tarball URL
(and a matching integrity for those bytes), so the install fetched the
attacker's bytes. A mismatch — or any entry that can't be confirmed
against the registry — is rejected with `ERR_PNPM_TARBALL_URL_MISMATCH`.
Non-registry resolutions (`file:`, git-hosted, etc.) and registry
entries without an explicit tarball URL (the URL is reconstructed from
name+version+registry, so it is inherently bound) are unaffected;
non-standard registry tarball URLs (npm Enterprise, GitHub Packages)
still pass because they match the metadata.

- Fix `pnpm update --recursive --lockfile-only <pkg>@&#8203;<version>`
crashing with `Invalid Version` when the catalog entry for `<pkg>` is a
version range (e.g. `^21.2.10`) and `catalogMode` is `strict` or
`prefer`. The catalog–version comparison now skips the equality check
when either side is a range rather than passing a range to
`semver.eq()`, so range specifiers fall through to the existing mismatch
handling instead of throwing
[#&#8203;11570](https://redirect.github.com/pnpm/pnpm/issues/11570).

- Avoided a Node.js crash when pnpm exits after network requests on
Windows.

- Fixed packages being materialized into the virtual store without their
root-level files (`package.json`, `LICENSE`, README, root entrypoints)
when multiple `pnpm install` processes ran against the same
store/workspace concurrently. The fast import path used to destructively
empty the shared target directory, so a concurrent importer could wipe
files another importer had already written; if the surviving files
included the `package.json` completion marker, every later install
treated the broken directory as complete and never repaired it. The fast
path now imports directly only when it can create the target directory
exclusively, and otherwise builds the package in a private temp
directory and atomically renames it into place
[#&#8203;12197](https://redirect.github.com/pnpm/pnpm/issues/12197).

- Fix dependency build scripts not running under the global virtual
store (`enableGlobalVirtualStore`).

In a workspace install, dependency build scripts are deferred to a
single `rebuild` pass (`buildProjects`). That pass resolved each
package's location from the classic
`node_modules/.pnpm/<depPathToFilename>` layout, which does not exist
under the global virtual store — so native dependencies (e.g. packages
using `node-gyp` / `prebuild-install`) were never built and failed to
load at runtime (`Cannot find module .../build/Release/*.node`).

`buildProjects` now resolves the global-virtual-store projection
directory (`<storeDir>/links/<hash>`, computed with the same graph hash
the installer uses) when `enableGlobalVirtualStore` is set, and
serializes concurrent builds of the same shared projection so parallel
workspace projects don't race on the same directory.

- Don't promote a `runtime:` dependency (such as the Node.js version
from `devEngines.runtime` or `pnpm runtime set`) into a catalog when
`catalogMode` is `strict` or `prefer`. A `runtime:` dependency
round-trips to `devEngines.runtime`, which only recognizes the
`runtime:` protocol; cataloging it rewrote the manifest entry to
`catalog:`, which broke that round-trip, stranded it in
`devDependencies`, and left `devEngines.runtime` untouched.

- Skip lockfile `minimumReleaseAge`/`trustPolicy` verification for
non-registry tarball protocols (for example `file:`), so local tarball
dependencies are not incorrectly checked against npm registry metadata.

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-15 00:57:02 +00:00
renovate[bot] 12d56c8299 chore(deps): update dependency @types/node to v22.19.20 (#12301) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node))
| [`22.19.19` →
`22.19.20`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.19/22.19.20)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@types%2fnode/22.19.20?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@types%2fnode/22.19.19/22.19.20?slim=true)
|

---

> [!WARNING]
> Some dependencies could not be looked up. Check the [Dependency
Dashboard](../issues/959) for more information.

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMTkuMCIsInVwZGF0ZWRJblZlciI6IjQzLjIxOS4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-14 22:23:17 +00:00
renovate[bot] f2b1bd4944 chore(deps): update dependency del-cli to v7 (#11874) 2026-06-11 13:40:14 +02:00
renovate[bot] c52116254a chore(deps): update vitest monorepo to v4.1.8 (#12285) 
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@vitest/coverage-v8](https://vitest.dev/guide/coverage)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8))
| [`4.1.5` →
`4.1.8`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-v8/4.1.5/4.1.8)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fcoverage-v8/4.1.8?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fcoverage-v8/4.1.5/4.1.8?slim=true)
|
| [@vitest/ui](https://vitest.dev/guide/ui)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/ui))
| [`4.1.5` →
`4.1.8`](https://renovatebot.com/diffs/npm/@vitest%2fui/4.1.5/4.1.8) |
![age](https://developer.mend.io/api/mc/badges/age/npm/@vitest%2fui/4.1.8?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@vitest%2fui/4.1.5/4.1.8?slim=true)
|
| [vitest](https://vitest.dev)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
| [`4.1.5` →
`4.1.8`](https://renovatebot.com/diffs/npm/vitest/4.1.5/4.1.8) |
![age](https://developer.mend.io/api/mc/badges/age/npm/vitest/4.1.8?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vitest/4.1.5/4.1.8?slim=true)
|

---

### Release Notes

<details>
<summary>vitest-dev/vitest (@&#8203;vitest/coverage-v8)</summary>

###
[`v4.1.8`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.8)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

#####    🐞 Bug Fixes

- **browser**:
- Disable client `cdp` API when `allowWrite/allowExec: false` \[backport
to v4]  -  by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa)
and **Codex** in
[#&#8203;10450](https://redirect.github.com/vitest-dev/vitest/issues/10450)
[<samp>(e4067)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/e4067b3b1)
- Remove orphaned Playwright route when same module is mocked via
multiple ids \[backport to v4]  -  by
[@&#8203;toxik](https://redirect.github.com/toxik) and
[@&#8203;Zelys-DFKH](https://redirect.github.com/Zelys-DFKH) in
[#&#8203;10474](https://redirect.github.com/vitest-dev/vitest/issues/10474)
[<samp>(675b4)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/675b4343f)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.7...v4.1.8)

###
[`v4.1.7`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.7)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7)

#####    🐞 Bug Fixes

- **runner**: Limit concurrency per task branch in addition to per leaf
callbacks (backport)  -  by
[@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa) in
[#&#8203;10384](https://redirect.github.com/vitest-dev/vitest/issues/10384)
[<samp>(4f0f2)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/4f0f2a1ee)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.6...v4.1.7)

###
[`v4.1.6`](https://redirect.github.com/vitest-dev/vitest/releases/tag/v4.1.6)

[Compare
Source](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6)

#####    🐞 Bug Fixes

- **browser**: Provide project reference in
`ToMatchScreenshotResolvePath`  -  by
[@&#8203;macarie](https://redirect.github.com/macarie) and
[@&#8203;sheremet-va](https://redirect.github.com/sheremet-va) in
[#&#8203;10138](https://redirect.github.com/vitest-dev/vitest/issues/10138)
[<samp>(31882)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/31882607c)
- Global `sequence.concurrent: true` with top-level `test(..., {
concurrent: false })` + depreacte `sequential` test API and options  - 
by [@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa), **Codex**
and [@&#8203;sheremet-va](https://redirect.github.com/sheremet-va) in
[#&#8203;10196](https://redirect.github.com/vitest-dev/vitest/issues/10196)
[<samp>(2847d)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/2847dfa2a)
- **browser**: Simplify orchestrator otel carrier  -  by
[@&#8203;hi-ogawa](https://redirect.github.com/hi-ogawa) in
[#&#8203;10285](https://redirect.github.com/vitest-dev/vitest/issues/10285)
[<samp>(18af9)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/18af98cee)

#####    🏎 Performance

- Stringify diff objects only once  -  by
[@&#8203;sheremet-va](https://redirect.github.com/sheremet-va) in
[#&#8203;10276](https://redirect.github.com/vitest-dev/vitest/issues/10276)
[<samp>(9f7b1)</samp>](https://redirect.github.com/vitest-dev/vitest/commit/9f7b1528c)

#####     [View changes on
GitHub](https://redirect.github.com/vitest-dev/vitest/compare/v4.1.5...v4.1.6)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Europe/Madrid)

- Branch creation
  - "after 7pm every weekday,before 5am every weekday"
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/Unleash/unleash).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDkuNCIsInVwZGF0ZWRJblZlciI6IjQzLjIwOS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
 2026-06-11 05:48:21 +00:00
renovate[bot] 62caf7a9f3 chore(deps): update dependency concurrently to v10 (#12267) 2026-06-10 11:43:13 +02:00