Repository navigation
Conversation
Resolves Dependabot alert GHSA-ch52-4w7c-c8xp (CVE-2026-93748), transitive via gamedig > got > cacheable-request.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bumps the transitive
http-cache-semanticsdependency inpackage-lock.jsonfrom 4.1.1 to 4.3.0, which resolves Dependabot alert 1 (GHSA-ch52-4w7c-c8xp / CVE-2026-93748, high:max-stalehandling can disclose cross-user cached responses). The advisory lists<= 4.2.0as vulnerable.The package comes in via
gamedig>got>cacheable-request. Only the lockfile changes;package.jsonis untouched.Note that
check_gamedig.shdownloadspackage.jsononly and runsnpm install/npm update, so user installs already resolve to the latesthttp-cache-semantics. This change mainly brings the repo lockfile in line and clears the alert.Related to Dependabot alert GHSA-ch52-4w7c-c8xp (no issue).
Affected servers: all (Gamedig query)
Type of change
Testing
npm update http-cache-semantics --package-lock-only, thennpm ciin a clean directory from the updated lockfile,npm audit --omit=dev, and agamedigCLI query.http-cache-semantics4.3.0,npm auditreports 0 vulnerabilities, and thegamedigCLI runs (returns the expected "Failed all 2 attempts" against a closed port).Risk and rollback
Breaking changes
Documentation
Checklist
PR will not be merged until all steps are complete.
Thank you for your Pull Request!