This repository has been archived by the owner on Aug 6, 2024. It is now read-only.
Update dependency @keystone-6/core to v5.5.1 [SECURITY] #419
+602
−808
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.1.0
->5.5.1
GitHub Vulnerability Alerts
CVE-2023-40027
Summary
When
ui.isAccessAllowed
isundefined
, theadminMeta
GraphQL query is publicly accessible, that is to say, no session is required for the query.This is different to the behaviour of the default AdminUI middleware, which by default will only be publicly accessible if a
session
strategy is not defined.Impact
This vulnerability does not affect developers using the
@keystone-6/auth
package, or any users that have written their ownui.isAccessAllowed
(that is to say, you are unaffected ifui.isAccessAllowed
is defined).This vulnerability does affect developers who thought that their
session
strategy will, by default, enforce thatadminMeta
is inaccessible by the public in accordance with that strategy; akin to the behaviour of the AdminUI middleware.Patches
This vulnerability has been patched in
@keystone-6/core
version5.5.1
.Workarounds
You can opt to write your own
isAccessAllowed
to work-around this vulnerability.References
Pull request https://github.com/keystonejs/keystone/pull/8771
Release Notes
keystonejs/keystone (@keystone-6/core)
v5.5.1
Compare Source
v5.5.0
Compare Source
v5.4.0
Compare Source
v5.3.2
Compare Source
v5.3.1
Compare Source
v5.3.0
Compare Source
v5.2.0
Compare Source
Configuration
📅 Schedule: Branch creation - "" in timezone Australia/Sydney, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.