[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@octokit/auth-app	8.3.0 → 8.3.1
@octokit/graphql	9.0.4 → 9.0.5
@octokit/request	10.0.15 → 10.0.16

---

Release Notes

octokit/auth-app.js (@​octokit/auth-app)

v8.3.1

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v18 (#​761) (2bb6310)

octokit/graphql.js (@​octokit/graphql)

v9.0.5

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v18 (#​707) (50222c3)

octokit/request.js (@​octokit/request)

v10.0.16

Compare Source

Bug Fixes

• deps: update dependency @​octokit/types to v18 (#​834) (723070e)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

JS Dependency Audit

0 added · 0 removed · 14 total (0 vs base)

Projects audited

• . (manager: npm)

No change in vulnerabilities compared to the base branch.

Full current vulnerability list (14)

• 🟠 high undici (>=6.0.0 <6.24.0) — Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client advisory
• 🟠 high undici (<6.24.0) — Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression advisory
• 🟠 high undici (<6.24.0) — Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation advisory
• 🟠 high undici (<6.27.0) — undici WebSocket client vulnerable to denial of service via fragment count bypass advisory
• 🟠 high undici (>=6.7.0 <6.28.1) — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol advisory
• 🟡 moderate undici (<6.24.0) — Undici has an HTTP Request/Response Smuggling issue advisory
• 🟡 moderate undici (<6.24.0) — Undici has CRLF Injection in undici via upgrade option advisory
• 🟡 moderate undici (<6.27.0) — undici vulnerable to HTTP header injection via Set-Cookie percent-decoding advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to downstream response desynchronization via retry interceptor advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to CRLF Injection via blob-like body 'type' property advisory
• 🟡 moderate undici (<6.28.0) — undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields advisory
• 🔵 low undici (<6.27.0) — undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching advisory
• 🔵 low undici (<6.27.0) — undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse advisory
• 🔵 low undici (<6.28.1) — undici vulnerable to downstream response splitting via retry interceptor advisory