Skip to content

fix(deps): bump http-cache-semantics to 4.3.0 - #5096

Open
dgibbs64 wants to merge 1 commit into
developfrom
fix/http-cache-semantics-cve
Open

dgibbs64 wants to merge 1 commit into
developfrom
fix/http-cache-semantics-cve

Conversation

@dgibbs64

Copy link
Copy Markdown
Member

Description

Bumps the transitive http-cache-semantics dependency in package-lock.json from 4.1.1 to 4.3.0, which resolves Dependabot alert 1 (GHSA-ch52-4w7c-c8xp / CVE-2026-93748, high: max-stale handling can disclose cross-user cached responses). The advisory lists <= 4.2.0 as vulnerable.

The package comes in via gamedig > got > cacheable-request. Only the lockfile changes; package.json is untouched.

Note that check_gamedig.sh downloads package.json only and runs npm install/npm update, so user installs already resolve to the latest http-cache-semantics. This change mainly brings the repo lockfile in line and clears the alert.

Related to Dependabot alert GHSA-ch52-4w7c-c8xp (no issue).

Affected servers: all (Gamedig query)

Type of change

  • Bug fix (a change which fixes an issue).
  • New feature (a change which adds functionality).
  • New Server (new server added).
  • Refactor (restructures existing code).
  • Chore (CI, workflows, tooling or other maintenance).
  • Comment update (typo, spelling, explanation, examples, etc).

Testing

  • Commands/tests run: npm update http-cache-semantics --package-lock-only, then npm ci in a clean directory from the updated lockfile, npm audit --omit=dev, and a gamedig CLI query.
  • Result: installs cleanly with http-cache-semantics 4.3.0, npm audit reports 0 vulnerabilities, and the gamedig CLI runs (returns the expected "Failed all 2 attempts" against a closed port).
  • Environment used (distro/version): Ubuntu 26.04, Node.js 22.22.1, npm 9.2.0.

Risk and rollback

  • Risk level: low
  • Rollback plan: revert this commit.

Breaking changes

  • No breaking changes.
  • Breaking changes included (describe below).

Documentation

Checklist

PR will not be merged until all steps are complete.

  • This pull request links to an issue ("Fixes", or "Related to" for a partial fix).
  • This pull request uses the develop branch as its base.
  • This pull request subject follows the Conventional Commits standard.
  • This code follows the style guidelines of this project.
  • I have performed a self-review of my code.
  • I have provided a detailed enough description of this PR.

Thank you for your Pull Request!

Resolves Dependabot alert GHSA-ch52-4w7c-c8xp (CVE-2026-93748), transitive via gamedig > got > cacheable-request.
@dgibbs64 dgibbs64 added this to the v26.5.0 milestone Oct 18, 2026
@github-actions github-actions Bot added info: dependency type: bugfix Pull request that fixes a bug labels Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

info: dependency type: bugfix Pull request that fixes a bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant