From 6eeadeb2fa22f8450b645cefb65e331ae8353024 Mon Sep 17 00:00:00 2001 From: Sven Date: Mon, 8 Jun 2026 19:10:58 +0200 Subject: [PATCH] security: update @fedify/fedify + @fedify/vocab-runtime to 2.2.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Patches CVE-2026-50131 (GHSA-xw9q-2mv6-9fr8, CVSS 8.6) — incomplete SSRF mitigation in isValidPublicIPv4Address() that allowed requests to special-use IPv4 ranges (CGNAT 100.64.0.0/10, multicast, documentation). Promote both @fedify/fedify and @fedify/vocab-runtime to direct dependencies pinned at ^2.2.5 to prevent transitive resolution back to vulnerable versions. Was 2.2.1 -> now 2.2.5 (fix is in 2.2.4+). Refs: https://github.com/fedify-dev/fedify/security/advisories/GHSA-xw9q-2mv6-9fr8 --- package-lock.json | 53 +++++++++++++++++++++++++---------------------- package.json | 2 ++ 2 files changed, 30 insertions(+), 25 deletions(-) diff --git a/package-lock.json b/package-lock.json index ba708580..cbc10cc0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,6 +10,8 @@ "hasInstallScript": true, "license": "ISC", "dependencies": { + "@fedify/fedify": "^2.2.5", + "@fedify/vocab-runtime": "^2.2.5", "@indiekit/endpoint-json-feed": "^1.0.0-beta.25", "@indiekit/indiekit": "^1.0.0-beta.27", "@indiekit/post-type-repost": "^1.0.0-beta.25", @@ -313,9 +315,9 @@ } }, "node_modules/@digitalbazaar/http-client/node_modules/undici": { - "version": "6.25.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz", - "integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==", + "version": "6.26.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-6.26.0.tgz", + "integrity": "sha512-4yqz8a3n5HmGTlsbADNtr/dJlhkh/55Rq798G6ibiULcXbDtaLpTl1pvdqcbFfeoj3iSi52lePFM7h9H21cw/A==", "license": "MIT", "engines": { "node": ">=18.17" @@ -781,18 +783,18 @@ } }, "node_modules/@fedify/fedify": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.2.1.tgz", - "integrity": "sha512-OIxa7+Kp6KDpz8v6bgo67Zg8fWRNdyNbOx21WrJbPhh6RaSl7SkVm1GAQ2ehIS318ipoFUD00DvM6sKbcR+DYg==", + "version": "2.2.5", + "resolved": "https://registry.npmjs.org/@fedify/fedify/-/fedify-2.2.5.tgz", + "integrity": "sha512-nARV2R/lkPgUb7XBZkg+MjmZUr0vkoEWG2w/+7Rle7uf2jgk8bL3axxl95xUkvf7gWwqHrBXgw9RXWReMFIFaw==", "funding": [ "https://opencollective.com/fedify", "https://github.com/sponsors/dahlia" ], "license": "MIT", "dependencies": { - "@fedify/vocab": "2.2.1", - "@fedify/vocab-runtime": "2.2.1", - "@fedify/webfinger": "2.2.1", + "@fedify/vocab": "2.2.5", + "@fedify/vocab-runtime": "2.2.5", + "@fedify/webfinger": "2.2.5", "@js-temporal/polyfill": "^0.5.1", "@logtape/logtape": "^2.0.5", "@opentelemetry/api": "^1.9.0", @@ -833,18 +835,18 @@ } }, "node_modules/@fedify/vocab": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.2.1.tgz", - "integrity": "sha512-sYVnwJLUYEiG6AuxR7Q+eYA3c+PzcZSDGxjmkFnMQ4mO1IU6G9Od85b66buGIV29g1+mgTYJLkBvNiLEOqBbaA==", + "version": "2.2.5", + "resolved": "https://registry.npmjs.org/@fedify/vocab/-/vocab-2.2.5.tgz", + "integrity": "sha512-68CYYd239zgfcVppUZGA7D90y0gEcAXNzSxUOBLy04XUZG6MUO81xk5k/j4l9Twagf1KtfQI/gwPpldfpBJeQQ==", "funding": [ "https://opencollective.com/fedify", "https://github.com/sponsors/dahlia" ], "license": "MIT", "dependencies": { - "@fedify/vocab-runtime": "2.2.1", - "@fedify/vocab-tools": "2.2.1", - "@fedify/webfinger": "2.2.1", + "@fedify/vocab-runtime": "2.2.5", + "@fedify/vocab-tools": "2.2.5", + "@fedify/webfinger": "2.2.5", "@js-temporal/polyfill": "^0.5.1", "@logtape/logtape": "^2.0.5", "@multiformats/base-x": "^4.0.1", @@ -861,15 +863,16 @@ } }, "node_modules/@fedify/vocab-runtime": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.2.1.tgz", - "integrity": "sha512-NRnlhUv2mmVGNMrjhmTUMN1gZaDax8KmBkUHV3U5PMDSA2aSGQ/iWCruoV4TeaCAI1nX1AW0kAH8Q9Uwkb6f8Q==", + "version": "2.2.5", + "resolved": "https://registry.npmjs.org/@fedify/vocab-runtime/-/vocab-runtime-2.2.5.tgz", + "integrity": "sha512-EiPkMwBqYsoSrllMOCFb0RTDwEO6XvppMmPa81lCux+7g9zXygKrJb9hJ9PP8Zi59+cJGqIF/Gdhug239+tZug==", "funding": [ "https://opencollective.com/fedify", "https://github.com/sponsors/dahlia" ], "license": "MIT", "dependencies": { + "@js-temporal/polyfill": "^0.5.1", "@logtape/logtape": "^2.0.5", "@multiformats/base-x": "^4.0.1", "@opentelemetry/api": "^1.9.0", @@ -885,9 +888,9 @@ } }, "node_modules/@fedify/vocab-tools": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.2.1.tgz", - "integrity": "sha512-b8Gu/clgudHjSSWEVrzm3N85xlAk23keNAxLPL6uQp+oybtG7ZvBXyUMOwFvrQLKtAmcPvRh0XXVETMN2hWv2g==", + "version": "2.2.5", + "resolved": "https://registry.npmjs.org/@fedify/vocab-tools/-/vocab-tools-2.2.5.tgz", + "integrity": "sha512-D5GMXvcoSeNhI68BBPlpLHAlI7dqc0pheqj3NDCp9f5bBagXz7o+oevzzjZFxiHgxYQfRVoZ2N5lFNEy5d27gQ==", "funding": [ "https://opencollective.com/fedify", "https://github.com/sponsors/dahlia" @@ -906,16 +909,16 @@ } }, "node_modules/@fedify/webfinger": { - "version": "2.2.1", - "resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.2.1.tgz", - "integrity": "sha512-gRGgjCLgfvovLstTAa7U4d170SsQQSb0pIPCyE7hMRvzdgU+uIPwbtgm5Btbe/ZognzCN2Q6ELx+tAsuQGbY5g==", + "version": "2.2.5", + "resolved": "https://registry.npmjs.org/@fedify/webfinger/-/webfinger-2.2.5.tgz", + "integrity": "sha512-NHJ0Q+YXbkE3mmQZhf5/UccSTOVUwtOCm9bQmFKGd8BbY5HCnjMceVZqLlCLT4AC6d7o5j9717KPl7+B2b7XvA==", "funding": [ "https://opencollective.com/fedify", "https://github.com/sponsors/dahlia" ], "license": "MIT", "dependencies": { - "@fedify/vocab-runtime": "2.2.1", + "@fedify/vocab-runtime": "2.2.5", "@logtape/logtape": "^2.0.5", "@opentelemetry/api": "^1.9.0", "es-toolkit": "1.43.0" diff --git a/package.json b/package.json index 735469bc..fbf0eb99 100644 --- a/package.json +++ b/package.json @@ -23,6 +23,8 @@ "@indiekit/frontend": "npm:@rmdes/indiekit-frontend@^1.0.0-beta.37" }, "dependencies": { + "@fedify/fedify": "^2.2.5", + "@fedify/vocab-runtime": "^2.2.5", "@indiekit/endpoint-json-feed": "^1.0.0-beta.25", "@indiekit/indiekit": "^1.0.0-beta.27", "@indiekit/post-type-repost": "^1.0.0-beta.25",