fix(deps): update dependency gatsby to v4 [security] #57
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^2.20.27
->^4.0.0
GitHub Vulnerability Alerts
CVE-2023-34238
Impact
The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the
__file-code-frame
and__original-stack-frame
paths, exposed when running the Gatsby develop server (gatsby develop
).The following steps can be used to reproduce the vulnerability:
It should be noted that by default
gatsby develop
is only accessible via the localhost127.0.0.1
, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as--host 0.0.0.0
,-H 0.0.0.0
, or theGATSBY_HOST=0.0.0.0
environment variable.Patches
A patch has been introduced in
gatsby@5.9.1
andgatsby@4.25.7
which mitigates the issue.Workarounds
As stated above, by default
gatsby develop
is only exposed to the localhost127.0.0.1
. For those using the develop server in the default configuration no risk is posed. If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.
Credits
We would like to thank Maxwell Garrett of Assetnote for bringing the
__file-code-frame
issue to our attention.For more information
Email us at security@gatsbyjs.com.
Release Notes
gatsbyjs/gatsby (gatsby)
v4.25.7
Compare Source
v4.25.6
Compare Source
v4.25.5
Compare Source
v4.25.4
Compare Source
v4.25.3
Compare Source
v4.25.2
Compare Source
v4.25.1
Compare Source
v4.25.0
Compare Source
v4.24.8
Compare Source
v4.24.7
Compare Source
v4.24.6
Compare Source
v4.24.5
Compare Source
v4.24.4
Compare Source
v4.24.3
Compare Source
v4.24.2
Compare Source
v4.24.1
Compare Source
v4.24.0
: v4.24Compare Source
Welcome to
gatsby@4.24.0
release (September 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.23.1
Compare Source
v4.23.0
: v4.23Compare Source
Welcome to
gatsby@4.23.0
release (September 2022 #1)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.22.1
Compare Source
v4.22.0
: v4.22Compare Source
Welcome to
gatsby@4.22.0
release (August 2022 #3)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.21.1
Compare Source
v4.21.0
: v4.21Compare Source
Welcome to
gatsby@4.21.0
release (August 2022 #2)Key highlights of this release:
gatsby-plugin-mdx
v4Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.20.0
: v4.20Compare Source
Welcome to
gatsby@4.20.0
release (August 2022 #1)Key highlights of this release:
sort
and aggregation fields in Gatsby GraphQL SchemaBleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.19.2
Compare Source
v4.19.1
Compare Source
v4.19.0
: v4.19Compare Source
Welcome to
gatsby@4.19.0
release (July 2022 #2)Key highlights of this release:
react-helmet
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.18.2
Compare Source
v4.18.1
Compare Source
v4.18.0
: v4.18Compare Source
Welcome to
gatsby@4.18.0
release (July 2022 #1)Key highlights of this release:
typesOutputPath
option for GraphQL Typegen - Configure the location of the generated TypeScript typesgatsby develop
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.17.2
Compare Source
v4.17.1
Compare Source
v4.17.0
: v4.17Compare Source
Welcome to
gatsby@4.17.0
release (June 2022 #2)Key highlights of this release:
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.16.0
: v4.16Compare Source
Welcome to
gatsby@4.16.0
release (June 2022 #1)Key highlights of this release:
useContentfulImage
hookAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.15.2
Compare Source
v4.15.1
Compare Source
v4.15.0
: v4.15Compare Source
Welcome to
gatsby@4.15.0
release (May 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
[Full changelog][full-changelog]
v4.14.1
Compare Source
v4.14.0
: v4.14Compare Source
Welcome to
gatsby@4.14.0
release (May 2022 #1)Key highlights of this release:
gatsby-source-drupal
: Image CDN SupportAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.13.1
Compare Source
v4.13.0
: v4.13Compare Source
Welcome to
gatsby@4.13.0
release (April 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.12.1
Compare Source
v4.12.0
: v4.12Compare Source
Welcome to
gatsby@4.12.0
release (April 2022 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.11.3
Compare Source
v4.11.2
Compare Source
v4.11.1
Compare Source
v4.11.0
: v4.11Compare Source
Welcome to
gatsby@4.11.0
release (March 2022 #3)Key highlights of this release:
gatsby-source-shopify
v7Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.10.3
Compare Source
v4.10.2
Compare Source
v4.10.1
Compare Source
v4.10.0
: v4.10Compare Source
Welcome to
gatsby@4.10.0
release (March 2022 #2)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.9.3
Compare Source
v4.9.2
Compare Source
v4.9.1
Compare Source
v4.9.0
: v4.9Compare Source
Welcome to
gatsby@4.9.0
release (March 2022 #1)Key highlights of this release:
gatsby-config
andgatsby-node
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us know if you have any issues.Previous release notes
Full changelog
v4.8.2
Compare Source
v4.8.1
Compare Source
v4.8.0
: v4.8Compare Source
Welcome to
gatsby@4.8.0
release (February 2022 #2)Key highlights of this release:
gatsby-browser
andgatsby-ssr
gatsby-core-utils
andgatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.7.2
Compare Source
v4.7.1
Compare Source
v4.7.0
: v4.7Compare Source
Welcome to
gatsby@4.7.0
release (February 2022 #1)Key highlights of this release:
trailingSlash
Option - Now built into the Framework itselfcreatePages
- Speed improvements of at least 30%Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.6.2
Compare Source
v4.6.1
Compare Source
v4.6.0
: v4.6Compare Source
Welcome to
gatsby@4.6.0
release (January 2022 #2)Key highlights of this release:
gatsby-plugin-utils
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.5.5
Compare Source
v4.5.4
Compare Source
v4.5.3
Compare Source
v4.5.2
Compare Source
v4.5.1
Compare Source
v4.5.0
: v4.5Compare Source
Welcome to
gatsby@4.5.0
release (January 2022 #1)Key highlights of this release:
getServerData
gatsby-recipes
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.4.0
: v4.4Compare Source
Welcome to
gatsby@4.4.0
release (December 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.3.0
: v4.3Compare Source
Welcome to
gatsby@4.3.0
release (November 2021 #3)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.2.0
: v4.2Compare Source
Welcome to
gatsby@4.2.0
release (November 2021 #2).Key highlights of this release:
gatsby-source-contentful
v7getServerData
improvementsAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.1.6
Compare Source
v4.1.5
Compare Source
v4.1.4
Compare Source
v4.1.3
Compare Source
v4.1.2
Compare Source
v4.1.1
Compare Source
v4.1.0
: v4.1Compare Source
Welcome to
gatsby@4.1.0
release (November 2021 #1).Key highlights of this release:
gatsby-config.js
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v4.0.2
Compare Source
v4.0.1
Compare Source
v4.0.0
: v4.0.0Compare Source
Welcome to
gatsby@4.0.0
release (October 2021 #1).We've released Gatsby 3 in March 2021 and now have a lot of exciting new features for Gatsby 4!
We’ve tried to make migration smooth. Please refer to the migration guide
and let us know if you encounter any issues when migrating.
Key highlights of this release:
Also check out notable bugfixes and improvements.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes for 3.14
Full changelog
v3.15.0
Compare Source
v3.14.6
Compare Source
v3.14.5
Compare Source
v3.14.4
Compare Source
v3.14.3
Compare Source
v3.14.2
Compare Source
v3.14.1
Compare Source
v3.14.0
: v3.14 (September 2021 #1)Compare Source
Welcome to
gatsby@3.14.0
release (September 2021 #1)Key highlights of this release:
createPages
snippet in GraphiQL and new GraphQL capabilitygatsby-source-drupal
gatsby-plugin-netlify
Also, check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.13.1
Compare Source
v3.13.0
: v3.13 (August 2021 #3)Compare Source
Welcome to
gatsby@3.13.0
release (August 2021 #3)Key highlights of this release:
sharp
v0.29 - Reduced install size, improved encoding time, and improved AVIF image qualitygatsby-source-drupal
- Speed up fetching data by around 4xAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.12.1
Compare Source
v3.12.0
: v3.12 (August 2021 #2)Compare Source
Welcome to
gatsby@3.12.0
release (August 2021 #2)Key highlights of this release:
webpack
dev server caching - opt-in 20% of usersgatsby-source-shopify
- Add compat for breaking change in Shopify's APIgatsby-source-wordpress
- Support for generating WebP images in HTML fieldsAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.11.1
Compare Source
v3.11.0
: v3.11 (August 2021 #1)Compare Source
Welcome to
gatsby@3.11.0
release (August 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.10.2
Compare Source
v3.10.1
Compare Source
v3.10.0
: v3.10 (July 2021 #2)Compare Source
Welcome to
gatsby@3.10.0
release (July 2021 #2)Key highlights of this release:
gatsby develop
- significantly speed up start of webpack serverAlso check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.9.1
Compare Source
v3.9.0
: v3.9 (July 2021 #1)Compare Source
Welcome to
gatsby@3.9.0
release (July 2021 #1)Key highlights of this release:
Also check out notable bugfixes.
Bleeding Edge: Want to try new features as soon as possible? Install
gatsby@next
and let us knowif you have any issues.
Previous release notes
Full changelog
v3.8.1
Compare Source
v3.8.0
: v3.8 (June 2021 #2)Compare Source
Welcome to
gatsby@3.8.0
release (June 2021 #2)Key highlights of this release:
gatsby-source-shopify
v5Configuration
📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.