@atproto-labs/fetch-node - npm Package Compare versions

Comparing version 0.1.1 to 0.1.2

CHANGELOG.md

 # @atproto-labs/fetch-node
 
+## 0.1.2
+
+### Patch Changes
+
+- [#2854](https://github.com/bluesky-social/atproto/pull/2854) [`8943c1008`](https://github.com/bluesky-social/atproto/commit/8943c10082702bbc0fc150237c6cc421251afd51) Thanks [@matthieusieben](https://github.com/matthieusieben)! - Disable use of HTTP2 when checking SSRF IP
+
 ## 0.1.1
@@ -4,0 +10,0 @@

dist/unicast.js

@@ -69,3 +69,5 @@ "use strict";
                     const dispatcher = new undici_1.Client(url.origin, {
-                        allowH2: true,
+                        // Do *not* enable H2 here, as it will cause an error (the client
+                        // will terminate the connection before the response is consumed).
+                        // https://github.com/nodejs/undici/issues/3671
                         connect: {
@@ -72,0 +74,0 @@ keepAlive: false, // Client will be used once

package.json

 {
   "name": "@atproto-labs/fetch-node",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "license": "MIT",
@@ -5,0 +5,0 @@ "description": "SSRF protection for fetch() in Node.js",

src/unicast.ts

@@ -109,3 +109,5 @@ import dns, { LookupAddress } from 'node:dns'
           const dispatcher = new Client(url.origin, {
-            allowH2: true,
+            // Do *not* enable H2 here, as it will cause an error (the client
+            // will terminate the connection before the response is consumed).
+            // https://github.com/nodejs/undici/issues/3671
             connect: {
@@ -112,0 +114,0 @@ keepAlive: false, // Client will be used once

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

33786

increased by2.21%

Lines of code

575

increased by0.7%

Number of medium supply chain risk alerts

7

decreased by-12.5%

No dependency changes