Bump minio from 8.0.5 to 8.0.6 in /web-app #12
Conversation
Bumps [minio](https://github.com/minio/minio-js) from 8.0.5 to 8.0.6. - [Release notes](https://github.com/minio/minio-js/releases) - [Commits](minio/minio-js@8.0.5...8.0.6) --- updated-dependencies: - dependency-name: minio dependency-version: 8.0.6 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
dependencies
Needs ReviewI recommend reviewing this upgrade before merging because it addresses multiple critical security vulnerabilities including three high-severity issues (privilege escalation in IAM API, information disclosure of credentials, and remote code execution with CVSS 8.8 actively exploited in the wild), plus one medium-severity SFTP authentication bypass. While the minio library is only used in the test infrastructure as a development dependency and not shipped to production, the security vulnerabilities reported appear to affect the MinIO server rather than the JavaScript SDK. Additionally, the 8.x series has a history of breaking changes with previous releases being unlisted from npmjs.org, requiring verification that test suite compatibility is maintained before merging. What we checked
Dependency UsageThe MinIO client library is used exclusively in the test infrastructure to provide direct object storage operations during automated testing. This dependency enables the test suite to programmatically create buckets and upload test objects, supporting comprehensive end-to-end testing of the MinIO console web application's object storage management features. The library is installed as a development dependency and does not ship with the production application.
Other Usages (1)These usages were analyzed but no breaking changes were detected: minio
ChangesThe minio package was updated with 7 bug fixes addressing critical issues including large object uploads, XML parser error handling that now properly redirects to stream errors, tag parsing validation, and listing bugs in v1 API. The update also makes
View 7 more changes
References (4)[1]: Dependency upgrade from minio ^8.0.5 to ^8.0.6 in devDependencies [2]: MinIO client library imported and used for test infrastructure operations including creating buckets, uploading objects, and managing bucket versioning [3]: MinIO client instantiated with connection parameters for test operations - will need verification that API remains compatible with v8.0.6 [4]: Critical warning: Previous releases in the 8.x series broke APIs and were unlisted from npmjs.org, requiring careful version management and test suite validation (source link) fossabot analyzed this PR using static analysis and dependency research. |
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Bumps minio from 8.0.5 to 8.0.6.
Release notes
Sourced from minio's releases.
Commits
212f282fix: redirect xml parser error to stream error (#1416)5f2dc07fix documentation link (#1419)ebd419etest with node v24 (#1420)eab7cb6build(deps-dev): bump form-data from 4.0.0 to 4.0.47a67d9aUpdate package.json for type definition entry point (#1315)8654c77fix: makegetBucketRegionAsyncpublic (#1413)fbcfe63fix listing bug in v1 and add missing v1 version listing (#1405)6a821b5fix tag parsing and type and update validation and tests (#1399)d8c6721fix large object upload and and update functional test for 0 byte file upload...bcbd469Update version to next releaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)