thomas/dotfiles
0
1
Fork 0
Code Issues 1 Pull requests 8 Projects Releases Packages Wiki Activity Actions

Update dependency @mozilla/readability to ^0.6.0 [SECURITY] #4

Open
renovate wants to merge 1 commit from renovate/npm-mozilla-readability-vulnerability into main
pull from: renovate/npm-mozilla-readability-vulnerability
merge into: thomas:main
Conversation 0 Commits 1 Files changed 2 +6 -6
renovate commented 2026-10-03 04:03:38 +01:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
@mozilla/readability ^0.5.0 → ^0.6.0 age confidence

@​mozilla/readability Denial of Service through Regex

CVE-2025-2792 / GHSA-3p6v-hrg8-8qj7

More information

Details

Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service.

Additional Details are available at Bugzilla

Credit: DayShift

Severity

  • CVSS Score: 2.9 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

❗ Important

Release Notes retrieval for this PR were skipped because no github.com credentials were available.
If you are self-hosted, please see this instruction.

Configuration

📅 Schedule: (in timezone UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [@mozilla/readability](https://github.com/mozilla/readability) | [`^0.5.0` → `^0.6.0`](https://renovatebot.com/diffs/npm/@mozilla%2freadability/0.5.0/0.6.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/@mozilla%2freadability/0.6.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@mozilla%2freadability/0.5.0/0.6.0?slim=true) | --- ### @&#8203;mozilla/readability Denial of Service through Regex [CVE-2025-2792](https://nvd.nist.gov/vuln/detail/CVE-2025-2792) / [GHSA-3p6v-hrg8-8qj7](https://github.com/advisories/GHSA-3p6v-hrg8-8qj7) <details> <summary>More information</summary> #### Details Specially crafted titles may have caused a regular expression to excessively backtrack and cause a local denial of service. Additional Details are [available at Bugzilla](https://bugzilla.mozilla.org/show_bug.cgi?id=1948833) Credit: DayShift #### Severity - CVSS Score: 2.9 / 10 (Low) - Vector String: `CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P` #### References - [https://github.com/mozilla/readability/security/advisories/GHSA-3p6v-hrg8-8qj7](https://github.com/mozilla/readability/security/advisories/GHSA-3p6v-hrg8-8qj7) - [https://github.com/mozilla/readability/commit/1c4d63be3e7344c3dfdf76ebb05fd0d32de93eb3](https://github.com/mozilla/readability/commit/1c4d63be3e7344c3dfdf76ebb05fd0d32de93eb3) - [https://bugzilla.mozilla.org/show_bug.cgi?id=1948833](https://bugzilla.mozilla.org/show_bug.cgi?id=1948833) - [https://github.com/mozilla/readability](https://github.com/mozilla/readability) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-3p6v-hrg8-8qj7) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> > ❗ **Important** > > Release Notes retrieval for this PR were skipped because no github.com credentials were available. > If you are self-hosted, please see [this instruction](https://github.com/renovatebot/renovate/blob/master/docs/usage/examples/self-hosting.md#githubcom-token-for-release-notes). --- ### Configuration 📅 **Schedule**: (in timezone UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMzIuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjEzMi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
Update dependency @mozilla/readability to ^0.6.0 [SECURITY]
Some checks failed
Dependency security / osv (pull_request) Failing after 2s
Details
Dependency security / osv (push) Failing after 2s
Details
03fd706519
Some checks failed
Dependency security / osv (pull_request) Failing after 2s
Details
Dependency security / osv (push) Failing after 2s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/npm-mozilla-readability-vulnerability:renovate/npm-mozilla-readability-vulnerability
git switch renovate/npm-mozilla-readability-vulnerability

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff renovate/npm-mozilla-readability-vulnerability
git switch renovate/npm-mozilla-readability-vulnerability
git rebase main
git switch main
git merge --ff-only renovate/npm-mozilla-readability-vulnerability
git switch renovate/npm-mozilla-readability-vulnerability
git rebase main
git switch main
git merge --no-ff renovate/npm-mozilla-readability-vulnerability
git switch main
git merge --squash renovate/npm-mozilla-readability-vulnerability
git switch main
git merge --ff-only renovate/npm-mozilla-readability-vulnerability
git switch main
git merge renovate/npm-mozilla-readability-vulnerability
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thomas/dotfiles!4
No description provided.