Skip to content

Bump follow-redirects from 1.13.2 to 1.14.8#20

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/follow-redirects-1.14.8
Open

Bump follow-redirects from 1.13.2 to 1.14.8#20
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/follow-redirects-1.14.8

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 14, 2022

Bumps follow-redirects from 1.13.2 to 1.14.8.

Commits
  • 3d81dc3 Release version 1.14.8 of the npm package.
  • 62e546a Drop confidential headers across schemes.
  • 2ede36d Release version 1.14.7 of the npm package.
  • 8b347cb Drop Cookie header across domains.
  • 6f5029a Release version 1.14.6 of the npm package.
  • af706be Ignore null headers.
  • d01ab7a Release version 1.14.5 of the npm package.
  • 40052ea Make compatible with Node 17.
  • 86f7572 Fix: clear internal timer on request abort to avoid leakage
  • 2e1eaf0 Keep Authorization header on subdomain redirects.
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.13.2 to 1.14.8.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.13.2...v1.14.8)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 14, 2022
@s1jae
Copy link

s1jae commented Feb 14, 2022

Logo
Checkmarx AST – Scan Summary & Details6dc61e9c-32d8-4ea7-a17a-c883afb0870a

CxAST Violation Summary

HIGH26 HIGH
MEDIUM21 MEDIUM
LOW1 LOW

CxAST Results

Severity Issue File / Package Scan Engine
HIGH CVE-2021-23343 Yarn-path-parse-1.0.6 CxSCA
HIGH CVE-2021-23424 Yarn-ansi-html-0.0.7 CxSCA
HIGH CVE-2021-23440 Yarn-set-value-2.0.1 CxSCA
HIGH CVE-2021-27290 Yarn-ssri-6.0.1 CxSCA
HIGH CVE-2021-28092 Yarn-is-svg-3.0.0 CxSCA
HIGH CVE-2021-29059 Yarn-is-svg-3.0.0 CxSCA
HIGH CVE-2021-32803 Yarn-tar-6.1.0 CxSCA
HIGH CVE-2021-32804 Yarn-tar-6.1.0 CxSCA
HIGH CVE-2021-3757 Yarn-immer-8.0.1 CxSCA
HIGH CVE-2021-37701 Yarn-tar-6.1.0 CxSCA
HIGH CVE-2021-37712 Yarn-tar-6.1.0 CxSCA
HIGH CVE-2021-37713 Yarn-tar-6.1.0 CxSCA
HIGH CVE-2021-3777 Yarn-tmpl-1.0.4 CxSCA
HIGH CVE-2021-3803 Yarn-nth-check-1.0.2 CxSCA
HIGH CVE-2021-3807 Yarn-ansi-regex-2.1.1 CxSCA
HIGH CVE-2021-3807 Yarn-ansi-regex-4.1.0 CxSCA
HIGH CVE-2021-3807 Yarn-ansi-regex-5.0.0 CxSCA
HIGH CVE-2021-3918 Yarn-json-schema-0.2.3 CxSCA
HIGH CVE-2021-42740 Yarn-shell-quote-1.7.2 CxSCA
HIGH Cx35ef42d7-054c Yarn-ejs-2.7.4 CxSCA
HIGH Cx89601373-08db Yarn-debug-2.6.9 CxSCA
HIGH Cx89601373-08db Yarn-debug-3.2.7 CxSCA
HIGH Cx8bc4df28-fcf5 Yarn-debug-4.3.1 CxSCA
HIGH Cx8bc4df28-fcf5 Yarn-debug-2.6.9 CxSCA
HIGH Cx8bc4df28-fcf5 Yarn-debug-3.2.7 CxSCA
HIGH Cxdca8e59f-8bfe Yarn-inflight-1.0.6 CxSCA
MEDIUM CVE-2020-28469 Yarn-glob-parent-5.1.1 CxSCA
MEDIUM CVE-2020-28469 Yarn-glob-parent-3.1.0 CxSCA
MEDIUM CVE-2021-23362 Yarn-hosted-git-info-2.8.8 CxSCA
MEDIUM CVE-2021-23364 Yarn-browserslist-4.14.2 CxSCA
MEDIUM CVE-2021-23364 Yarn-browserslist-4.16.3 CxSCA
MEDIUM CVE-2021-23368 Yarn-postcss-8.2.6 CxSCA
MEDIUM CVE-2021-23368 Yarn-postcss-7.0.35 CxSCA
MEDIUM CVE-2021-23368 Yarn-postcss-7.0.21 CxSCA
MEDIUM CVE-2021-23382 Yarn-postcss-7.0.21 CxSCA
MEDIUM CVE-2021-23382 Yarn-postcss-8.2.6 CxSCA
MEDIUM CVE-2021-23382 Yarn-postcss-7.0.35 CxSCA
MEDIUM CVE-2021-23386 Yarn-dns-packet-1.3.1 CxSCA
MEDIUM CVE-2021-23436 Yarn-immer-8.0.1 CxSCA
MEDIUM CVE-2021-23566 Yarn-nanoid-3.1.20 CxSCA
MEDIUM CVE-2021-29060 Yarn-color-string-1.5.4 CxSCA
MEDIUM CVE-2021-32640 Yarn-ws-7.4.3 CxSCA
MEDIUM CVE-2021-32640 Yarn-ws-6.2.1 CxSCA
MEDIUM CVE-2021-3664 Yarn-url-parse-1.5.1 CxSCA
MEDIUM CVE-2022-0122 Yarn-node-forge-0.10.0 CxSCA
MEDIUM Cx14b19a02-387a Yarn-body-parser-1.19.0 CxSCA
MEDIUM Cx65603961-769c Yarn-debug-2.6.9 CxSCA
LOW Cxda14f253-4e52 Yarn-bluebird-3.7.2 CxSCA

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant