chore(deps): update dependency @discordjs/opus to ^0.8.0 [security] by renovate[bot] · Pull Request #27 · DogeHQ/dogehq

renovate · 2024-08-06T07:22:21Z

This PR contains the following updates:

Package	Change	Age	Confidence
@discordjs/opus	`^0.5.0` → `^0.8.0`

GitHub Vulnerability Alerts

CVE-2022-25345

Improperly handled errors in @discordjs/opus cause hard crashes instead of returning the error to user land. All versions of package @discordjs/opus (<= 0.7.0) are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash due to improperly returning the errors from the invalid inputs.

As of version 0.8.0, the errors are correctly returned to the user and are no longer throwing hard crashes that cannot be recovered.

Release Notes

discordjs/opus (@discordjs/opus)

`v0.8.0`: 0.8.0

Compare Source

Features

feat: support node 18 (9fa0d54, 185c78d, 5af481d, 344f064, 63555ae, 3befecb, b76e7a0)

Bug Fixes

fix: fix CVE (406249f)

`v0.7.0`: 0.7.0

Compare Source

Features

feat node 17 support (fbd68ee)

`v0.6.0`: 0.6.0

Compare Source

Features

feat add support for macos arm64 (d929bdb)

`v0.5.3`: 0.5.3

Compare Source

Features

chore remove outdated workflows (3ca4341)

`v0.5.2`: 0.5.2

Compare Source

Features

chore update deps to allow node 16 prebuilt downloads (22fd6b7)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-08-06T07:22:23Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

➤ YN0000: ┌ Resolution step
➤ YN0032: │ node-addon-api@npm:5.1.0: Implicit dependencies on node-gyp are discouraged
➤ YN0061: │ npmlog@npm:5.0.1 is deprecated: This package is no longer supported.
➤ YN0061: │ tar@npm:6.2.1 is deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me
➤ YN0061: │ are-we-there-yet@npm:2.0.0 is deprecated: This package is no longer supported.
➤ YN0061: │ gauge@npm:3.0.2 is deprecated: This package is no longer supported.
➤ YN0060: │ dogehq@workspace:. provides @discordjs/opus (p33a23) with version 0.8.0, which doesn't satisfy what prism-media requests
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
➤ YN0000: └ Completed in 1s 4ms
➤ YN0000: ┌ Fetch step
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT Installing the project using Yarn Classic
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT 
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT ➤ YN0000: Downloading https://nightly.yarnpkg.com/latest.js
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT ➤ YN0000: Saving the new release in .yarn/releases/yarn-1.22.22.cjs
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT ➤ YN0000: Done in 0s 966ms
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT 
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT yarn install v1.22.22
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR (node:959) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR (Use `node --trace-deprecation ...` to show where the warning was created)
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT [1/4] Resolving packages...
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT [2/4] Fetching packages...
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR error Error: certificate has expired
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR     at TLSSocket.onConnectSecure (node:_tls_wrap:1649:34)
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR     at TLSSocket.emit (node:events:508:28)
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR     at TLSSocket._finishInit (node:_tls_wrap:1094:8)
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDERR     at ssl.onhandshakedone (node:_tls_wrap:880:12)
➤ YN0000: │ /tmp/xfs-2b0d6e37 STDOUT info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
➤ YN0000: │ DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
➤ YN0001: │ Error: @types/wrtc@https://github.com/1chiSensei/wrtc-types.git#commit=f354aa34f215350c803670d40b671824d6cd7770: Repository clone failed: Child "git" exited with exit code 128

Cloning into '/tmp/xfs-c2cbb3e4'...
error: invalid key:  core.autocrlf
fatal: unable to write parameters to config file

    at ChildProcess.<anonymous> (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:405637)
    at ChildProcess.emit (node:events:508:28)
    at maybeClose (node:internal/child_process:1101:16)
    at Socket.<anonymous> (node:internal/child_process:457:11)
    at Socket.emit (node:events:508:28)
    at Pipe.<anonymous> (node:net:346:12)
➤ YN0001: │ TypeError: resolve@patch:resolve@npm%3A1.20.0#builtin<compat/resolve>::version=1.20.0&hash=3388aa: (0 , o.isDate) is not a function
    at /tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:485321
    at f.utimesImpl (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:485380)
    at f.utimesSync (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:484779)
    at f.utimesPromise (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:484645)
    at f.mkdirpPromise (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:447511)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async re.fetchers.patchPackage (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:261844)
    at async Q (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:289520)
    at async D (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:289979)
    at async /tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:290670
➤ YN0001: │ TypeError: typescript@patch:typescript@npm%3A4.2.4#builtin<compat/typescript>::version=4.2.4&hash=a45b0e: (0 , o.isDate) is not a function
    at /tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:485321
    at f.utimesImpl (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:485380)
    at f.utimesSync (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:484779)
    at f.utimesPromise (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:484645)
    at f.mkdirpPromise (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:447511)
    at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
    at async re.fetchers.patchPackage (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:261844)
    at async Q (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:289520)
    at async D (/tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:289979)
    at async /tmp/renovate/repos/github/DogeHQ/dogehq/.yarn/releases/yarn-berry.cjs:2:290670
➤ YN0013: │ 2 packages were already cached, 526 had to be fetched
➤ YN0000: └ Completed in 35s 526ms
➤ YN0000: Failed with errors in 36s 535ms

chore(deps): update dependency @discordjs/opus to ^0.8.0 [security]

bfad3c1

Navigation Menu

Uh oh!

chore(deps): update dependency @discordjs/opus to ^0.8.0 [security] - #27

chore(deps): update dependency @discordjs/opus to ^0.8.0 [security]#27
renovate[bot] wants to merge 1 commit into
devfrom
renovate/npm-discordjs-opus-vulnerability

renovate Bot commented Aug 6, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Aug 6, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Aug 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

CVE-2022-25345

Release Notes

v0.8.0: 0.8.0

Features

Bug Fixes

v0.7.0: 0.7.0

Features

v0.6.0: 0.6.0

Features

v0.5.3: 0.5.3

Features

v0.5.2: 0.5.2

Features

Configuration

Uh oh!

renovate Bot commented Aug 6, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: yarn.lock

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 6, 2024 •

edited

Loading

`v0.8.0`: 0.8.0

`v0.7.0`: 0.7.0

`v0.6.0`: 0.6.0

`v0.5.3`: 0.5.3

`v0.5.2`: 0.5.2

renovate Bot commented Aug 6, 2024 •

edited

Loading