chore: npm audit fix
#677
Merged
chore: npm audit fix
#677
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A couple of vulnerabilities were being reported (for node-forge and minimist), this should fix them.
|
|
I'll land this after CI passes. |
|
A wrangler prerelease is available for testing. You can install this latest build in your project with: npm install --save-dev https://prerelease-registry.developers.workers.dev/runs/2026949784/npm-package-wrangler-677You can reference the automatically updated head of this PR with: npm install --save-dev https://prerelease-registry.developers.workers.dev/prs/677/npm-package-wrangler-677Or you can use npx https://prerelease-registry.developers.workers.dev/runs/2026949784/npm-package-wrangler-677 dev path/to/script.js |
mrbbot
added a commit
that referenced
this pull request
Oct 31, 2023
Whilst prohibited by the `Request` API spec, `GET` requests are allowed to have bodies. If `Content-Length` or `Transfer-Encoding` are specified, `workerd` will give the request a (potentially empty) body. Passing a bodied-GET-request through to the `new Request()` constructor should throw, but `workerd` has special handling to allow this if a `Request` instance is passed. Miniflare was previously decomposing the request before passing it back to the `new Request()` constructor, defeating this detection. This change ensures we always pass full `Request` instances to the `new Request()` constructor in the entry worker. Closes cloudflare/workerd#1122
mrbbot
added a commit
that referenced
this pull request
Nov 1, 2023
Whilst prohibited by the `Request` API spec, `GET` requests are allowed to have bodies. If `Content-Length` or `Transfer-Encoding` are specified, `workerd` will give the request a (potentially empty) body. Passing a bodied-GET-request through to the `new Request()` constructor should throw, but `workerd` has special handling to allow this if a `Request` instance is passed. Miniflare was previously decomposing the request before passing it back to the `new Request()` constructor, defeating this detection. This change ensures we always pass full `Request` instances to the `new Request()` constructor in the entry worker. Closes cloudflare/workerd#1122
mrbbot
added a commit
that referenced
this pull request
Nov 1, 2023
Whilst prohibited by the `Request` API spec, `GET` requests are allowed to have bodies. If `Content-Length` or `Transfer-Encoding` are specified, `workerd` will give the request a (potentially empty) body. Passing a bodied-GET-request through to the `new Request()` constructor should throw, but `workerd` has special handling to allow this if a `Request` instance is passed. Miniflare was previously decomposing the request before passing it back to the `new Request()` constructor, defeating this detection. This change ensures we always pass full `Request` instances to the `new Request()` constructor in the entry worker. Closes cloudflare/workerd#1122
mrbbot
added a commit
that referenced
this pull request
Nov 1, 2023
Whilst prohibited by the `Request` API spec, `GET` requests are allowed to have bodies. If `Content-Length` or `Transfer-Encoding` are specified, `workerd` will give the request a (potentially empty) body. Passing a bodied-GET-request through to the `new Request()` constructor should throw, but `workerd` has special handling to allow this if a `Request` instance is passed. Miniflare was previously decomposing the request before passing it back to the `new Request()` constructor, defeating this detection. This change ensures we always pass full `Request` instances to the `new Request()` constructor in the entry worker. Closes cloudflare/workerd#1122
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
A couple of vulnerabilities were being reported (for node-forge and minimist), this should fix them.