fix(deps): update dependency octokit to v5 [security] by renovate[bot] · Pull Request #2702 · salute-developers/plasma

renovate · 2026-04-15T09:56:25Z

This PR contains the following updates:

Package	Change	Age	Confidence
octokit	`^1.7.1` → `^5.0.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Unauthenticated Denial of Service in the octokit/webhooks library

CVE-2023-50728 / GHSA-pwfr-8pq7-x9qv

More information

Details

Impact

Versions v9.26.0, v10.9.x), v11.1.x, v12.0.x all contained the code that would throw the error.

Specifically, during a pentest we encountered a bug in the octokit/webhooks library (a dependency of Probot, a framework for building Github Apps). The resulting request was found to cause an uncaught exception that ends the nodejs process.

The problem is caused by an issue with error handling in the @octokit/webhooks library because the error can be undefined in some cases.

Credit goes to @pb82 (for the early analysis) and @rh-tguittet (for discovery).

Patches

Maintenance releases for the Error being thrown by the verify method in octokit/webhooks.js

v12 - v12.0.4
v11 - v11.1.2
v10 -v10.9.2
v9 - v9.26.3

Maintenance release for the reference for octokit/webhooks.js in app.js

v14.0.2

Maintenance release for the reference for octokit/webhooks.js in octokit.js

v3.1.2

Maintenance release for the reference for octokit/webhooks.js in Protobot

v12.3.3

Workarounds

It is recommend that all users upgrade to the latest version of octokit/webhooks.js or use one of the updated back ported versions.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

octokit/octokit.js (octokit)

`v5.0.5`

Compare Source

Bug Fixes

deps: update octokit monorepo (major) (#2903) (45c56ff)

`v5.0.4`

Compare Source

Bug Fixes

deps: update dependency @octokit/types to v15 (#2880) (b84c9d4)

Bug Fixes

deps: update octokit monorepo (major) (#2853) (edfce61)

`v5.0.1`

Compare Source

Bug Fixes

deps: add explicit dependency on @octokit/webhooks (#2847) (2b5ed09), closes #2844

`v5.0.0`

Compare Source

Continuous Integration

stop testing against NodeJS v18 (#2846) (8ec7ed7)

BREAKING CHANGES

Drop support for NodeJS v18
ci: stop testing against NodeJS v18

`v4.1.4`

Compare Source

Bug Fixes

deps: add explicit dependency on @octokit/webhooks (#2847) (3589cd2), closes #2844

`v4.1.3`

Compare Source

Bug Fixes

deps: update octokit monorepo (major) (#2836) (4ccc6d3)

`v4.1.2`

Compare Source

Bug Fixes

deps: update Octokit dependencies to mitigate ReDos vulnerabilities [security] (#2816) (28ff745)

`v4.1.1`

Compare Source

Bug Fixes

deps: bump @octokit/app to fix web users (#2806) (137de2d)

`v4.1.0`

Compare Source

Features

deps: bump Octokit deps to fix Deno compatibility, new endpoints via @octokit/plugin-rest-endpoint-methods (#2788) (2107d79)

`v4.0.3`

Compare Source

Bug Fixes

deps: bump @octokit/app and @octokit/types (#2763) (33d03d9)

`v4.0.2`

Compare Source

Bug Fixes

build: actually output ESM (#2678) (9604674)

`v4.0.1`

Compare Source

Bug Fixes

docs: remove NodeJS 10 and add callout for conditional exports (#2675) (c99ff62)

`v4.0.0`

Compare Source

BREAKING CHANGES

package is now ESM
remove authentication type "oauth" that was previously deprecated
Switch from @octokit/webhooks-types to @octokit/openapi-webhooks-types due to the transition to using GitHub's OpenAPI schema

`v3.2.2`

Compare Source

Bug Fixes

ignore ts errors (eb683c2)
update dependencies (95220f3), closes #2844

`v3.2.1`

Compare Source

Bug Fixes

update rest endpoints (#2667) (98785f4)

`v3.2.0`

Compare Source

Features

security: Add provenance (#2653) (a90799a)

`v3.1.2`

Compare Source

Bug Fixes

updates app.js for the handling of an error being thrown by the verify method in webhooks.js (#2576) (b59da80)

`v3.1.1`

Compare Source

Bug Fixes

deps: update octokit monorepo (major) (#2541) (f366919)

`v3.1.0`

Compare Source

Features

add plugin-paginate-graphql (#2487) (74856f6)

`v3.0.0`

Compare Source

Features

v3 (#2456) (84e6569)

BREAKING CHANGES

Drop support for NodeJS v14, v16
Remove previews support for the REST API
remove agent option from octokit.request()
Replace support for Node.js http(s) Agents with documentation on using fetch dispatchers instead (via @octokit/request)
Remove ability to pass custom request options, except for method, headers, body, signal (via @octokit/request)

`v2.1.0`

Compare Source

Features

add RequestError support (#2465) (46b5f2f)

`v2.0.22`

Compare Source

Bug Fixes

deps: revert breaking changes (#2478) (6fb5995), closes #2475 #2474

`v2.0.21`

Compare Source

Bug Fixes

deps: update dependency @octokit/types to v10 (#2475) (310abe5)

`v2.0.20`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-throttling to v6 (#2474) (1fe2b74)

`v2.0.19`

Compare Source

Bug Fixes

deps: upgrade @octokit/app (#2460) (4db2da3)

`v2.0.18`

Compare Source

Bug Fixes

revert): revert "fix(deps: update dependency @octokit/plugin-throttling to v6" (#2455) (f6ee116)

`v2.0.17`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-throttling to v6 (1ab74b0)

`v2.0.16`

Compare Source

Bug Fixes

deps: update all @octokit modules (#2451) (3562907)

`v2.0.15`

Compare Source

Bug Fixes

build: replace pika with esbuild and tsc (#2449) (2cf77e1)

`v2.0.14`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-paginate-rest to v6 (#2384) (c423872)

`v2.0.13`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-rest-endpoint-methods to v7 (fb596ac)
deps: update dependency @octokit/plugin-throttling to v5 (409a4c4)

`v2.0.12`

Compare Source

Bug Fixes

deps: update dependency @octokit/types to v9 (1fcc8e6)

`v2.0.11`

Compare Source

Bug Fixes

deps: update @octokit/app in order to propogate fix to CVE-2022-23541 (#2374) (c067836)

`v2.0.10`

Compare Source

Bug Fixes

deps: update @octokit/plugin-retry to latest (#2334) (3ae9d29)

`v2.0.9`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-paginate-rest to v5 (#2327) (1156a65)

`v2.0.8`

Compare Source

Bug Fixes

deps: update dependency @octokit/types to v8 (cafda10)

`v2.0.7`

Compare Source

Bug Fixes

deps: update dependency @octokit/types to v7 (#2280) (37d6fd6)

`v2.0.6`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-paginate-rest to v4 (#2279) (42e8130)

`v2.0.5`

Compare Source

Bug Fixes

use "secondary" instead of "abuse" for rate limit (#2266) (650d10a)

`v2.0.4`

Compare Source

Bug Fixes

README: app.getInstallationOctokit() doesn't need destructuring (#2257) (989b291)

`v2.0.3`

Compare Source

Bug Fixes

deps: update @octokit dependencies to their latest version (#2248) (e714956)

`v2.0.2`

Compare Source

Bug Fixes

deps: update dependency @octokit/app to v13 (#2237) (1e8d41a)

`v2.0.1`

Compare Source

Bug Fixes

deps: update dependency @octokit/plugin-throttling to v4 (#2245) (36011d6)

`v2.0.0`

Compare Source

Continuous Integration

stop testing against NodeJS v10, v12 (#2243) (d9b6378)

BREAKING CHANGES

Drop support for NodeJS v10, v12

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

📦 Published PR as canary version: Canary Versions

✨ Test out this PR locally via:

npm install @salutejs/plasma-asdk@0.373.1-canary.2702.25033584134.0
npm install @salutejs/plasma-b2c@1.615.1-canary.2702.25033584134.0
npm install @salutejs/plasma-core@1.223.1-canary.2702.25033584134.0
npm install @salutejs/plasma-giga@0.342.1-canary.2702.25033584134.0
npm install @salutejs/plasma-homeds@0.342.1-canary.2702.25033584134.0
npm install @salutejs/plasma-hope@1.369.1-canary.2702.25033584134.0
npm install @salutejs/plasma-icons@1.235.1-canary.2702.25033584134.0
npm install @salutejs/plasma-new-hope@0.359.1-canary.2702.25033584134.0
npm install @salutejs/plasma-tokens@1.135.1-canary.2702.25033584134.0
npm install @salutejs/plasma-ui@1.345.1-canary.2702.25033584134.0
npm install @salutejs/plasma-web@1.617.1-canary.2702.25033584134.0
npm install @salutejs/sdds-bizcom@0.347.1-canary.2702.25033584134.0
npm install @salutejs/sdds-cs@0.351.1-canary.2702.25033584134.0
npm install @salutejs/sdds-dfa@0.345.1-canary.2702.25033584134.0
npm install @salutejs/sdds-finai@0.338.1-canary.2702.25033584134.0
npm install @salutejs/sdds-insol@0.342.1-canary.2702.25033584134.0
npm install @salutejs/sdds-netology@0.346.1-canary.2702.25033584134.0
npm install @salutejs/sdds-os@0.17.1-canary.2702.25033584134.0
npm install @salutejs/sdds-platform-ai@0.346.1-canary.2702.25033584134.0
npm install @salutejs/sdds-sbcom@0.346.1-canary.2702.25033584134.0
npm install @salutejs/sdds-scan@0.345.1-canary.2702.25033584134.0
npm install @salutejs/sdds-serv@0.346.1-canary.2702.25033584134.0
npm install @salutejs/core-themes@0.24.1-canary.2702.25033584134.0
npm install @salutejs/plasma-themes@0.47.1-canary.2702.25033584134.0
npm install @salutejs/sdds-themes@0.62.1-canary.2702.25033584134.0
npm install @salutejs/sdds-api-tests@0.4.1-canary.2702.25033584134.0
npm install @salutejs/plasma-cy-utils@0.153.1-canary.2702.25033584134.0
npm install @salutejs/plasma-sb-utils@0.223.1-canary.2702.25033584134.0
# or 
yarn add @salutejs/plasma-asdk@0.373.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-b2c@1.615.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-core@1.223.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-giga@0.342.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-homeds@0.342.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-hope@1.369.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-icons@1.235.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-new-hope@0.359.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-tokens@1.135.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-ui@1.345.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-web@1.617.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-bizcom@0.347.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-cs@0.351.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-dfa@0.345.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-finai@0.338.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-insol@0.342.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-netology@0.346.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-os@0.17.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-platform-ai@0.346.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-sbcom@0.346.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-scan@0.345.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-serv@0.346.1-canary.2702.25033584134.0
yarn add @salutejs/core-themes@0.24.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-themes@0.47.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-themes@0.62.1-canary.2702.25033584134.0
yarn add @salutejs/sdds-api-tests@0.4.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-cy-utils@0.153.1-canary.2702.25033584134.0
yarn add @salutejs/plasma-sb-utils@0.223.1-canary.2702.25033584134.0

renovate Bot requested review from TitanKuzmich, Yakutoc, Yeti-or, neretin-trike and shuga2704 as code owners April 15, 2026 09:56

renovate Bot temporarily deployed to internal April 15, 2026 09:56 Inactive

renovate Bot changed the title ~~fix(deps): update dependency octokit to v5 [security]~~ fix(deps): update dependency octokit to v5 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

renovate Bot deleted the renovate/npm-octokit-vulnerability branch April 27, 2026 17:49

fix(deps): update dependency octokit to v5 [security]

213e09a

renovate Bot changed the title ~~fix(deps): update dependency octokit to v5 [security] - autoclosed~~ fix(deps): update dependency octokit to v5 [security] Apr 28, 2026

renovate Bot reopened this Apr 28, 2026

renovate Bot force-pushed the renovate/npm-octokit-vulnerability branch 2 times, most recently from d59cf7c to 213e09a Compare April 28, 2026 04:16

renovate Bot temporarily deployed to internal April 28, 2026 04:16 Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency octokit to v5 [security]#2702

fix(deps): update dependency octokit to v5 [security]#2702
renovate[bot] wants to merge 1 commit into
devfrom
renovate/npm-octokit-vulnerability

renovate Bot commented Apr 15, 2026 •

edited by Yakutoc

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 15, 2026 • edited by Yakutoc Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unauthenticated Denial of Service in the octokit/webhooks library

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Continuous Integration

BREAKING CHANGES

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Bug Fixes

BREAKING CHANGES

Bug Fixes

Bug Fixes

Features

Bug Fixes

Bug Fixes

Features

Features

BREAKING CHANGES

Features

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Bug Fixes

Continuous Integration

BREAKING CHANGES

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Apr 15, 2026 •

edited by Yakutoc

Loading