Update dependency semantic-release to v25 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semantic-release	^17.0.4 → ^25.0.0

---

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

CVE-2022-31051 / GHSA-x2pg-mjhr-2m5x

More information

Details

Impact

What kind of vulnerability is it? Who is impacted?

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in 19.0.3

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

References

Are there any links users can visit to find out more?

• https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI

For more information

If you have any questions or comments about this advisory:

• Open a discussion in semantic-release discussions

Severity

• CVSS Score: 4.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

References

• https://github.com/semantic-release/semantic-release/security/advisories/GHSA-x2pg-mjhr-2m5x
• https://github.com/semantic-release/semantic-release/pull/2449
• https://github.com/semantic-release/semantic-release/pull/2459
• https://github.com/semantic-release/semantic-release/commit/58a226f29c04ee56bbb02cc661f020d568849cad
• https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3
• https://nvd.nist.gov/vuln/detail/CVE-2022-31051
• https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI
• https://github.com/advisories/GHSA-x2pg-mjhr-2m5x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

semantic-release/semantic-release (semantic-release)

v25.0.7

Compare Source

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

v25.0.5

Compare Source

Bug Fixes

• revert: next (#​4200) (db8ffaa)

v25.0.4

Compare Source

Bug Fixes

• code-quality: add missing comma in context object for consistency (493d6cd)

v25.0.3

Compare Source

Bug Fixes

• deps: remove deprecated semver-diff (#​3980) (f404124)

v25.0.2

Compare Source

Bug Fixes

• deps: update dependency read-package-up to v12 (#​3935) (1494cb9)

v25.0.1

Compare Source

Bug Fixes

• deps: update to the latest version of the npm plugin to add trusted publishing support (fad173e), closes semantic-release/npm#958

v25.0.0

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v9 (9fa04f8)
• deps: update dependency yargs to v18 (#​3745) (cde9a72)
• deps: update to the stable version of the github plugin (f12cf81)
• deps: update to the stable version of the release-notes-generator plugin (d9def72)
• deps: updated to the stable version of the commit-analyzer plugin (291533b)
• deps: upgrade to the new major version of the npm plugin, which upgrades npm to v11 for publishing (1be8290)

Features

• node-versions: drop support for node versions v20, v21, and v23 (56d16f4)
• node-versions: raise the minimum node version for the v24 range (116a188)

BREAKING CHANGES

• node-versions: the minimum node version for the v24 range is now v24.10.0
• node-versions: a minimum of node v22.14 is now required

v24.2.9

Compare Source

Bug Fixes

• deps: update dependency semver-diff to v5 (#​3867) (a834948)

v24.2.8

Compare Source

Bug Fixes

• deps: update dependency hook-std to v4 (#​3859) (67abe56)

v24.2.7

Compare Source

Performance Improvements

• get-tags.js: bulk get for tags notes (#​3732) (85187e2)

v24.2.6

Compare Source

Bug Fixes

• deps: update @​semantic-release/npm to ^12.0.2 (#​3791) (93177d0)

v24.2.5

Compare Source

Bug Fixes

• deps: raise the minimum of the defined range for marked-terminal (#​3742) (fb1ccd4)

v24.2.4

Compare Source

Bug Fixes

• deps: update dependency marked to v15 (#​3499) (e45040e)

v24.2.3

Compare Source

Bug Fixes

• types: fixed typescript definition (0e08b5c), closes #​3601

v24.2.2

Compare Source

Bug Fixes

• get-git-auth-url.js: Added debug for success (#​3595) (2616d93)

v24.2.1

Compare Source

Bug Fixes

• deps: update dependency import-from-esm to v2 (#​3556) (f15019c)

v24.2.0

Compare Source

Features

• clarify branch existence requirement in error messages (#​3462) (05a2ea9)

v24.1.3

Compare Source

Bug Fixes

• branch-naming: prevent non-range versions from being identified as maintenance branches (07f2672)

v24.1.2

Compare Source

Bug Fixes

• deps: update @semantic-release/github to v11.0.0 (#​3460) (43df51b)

v24.1.1

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v8 (#​3436) (ab10ac1)

v24.1.0

Compare Source

Features

• add warn type to global context.logger (#​3423) (bcc663c)

v24.0.0

Compare Source

Bug Fixes

• deps: upgraded to the beta of the commit-analyzer plugin (dfc3d91)
• deps: upgraded to the beta of the release-notes-generator plugin (4a4cd92)

BREAKING CHANGES

• deps: the commit-analyzer plugin now expects to be used with the latest major versions of
  conventional-changelog packages. if you are installing any of these packages in addition to
  semantic-release, be sure to update them as well
• deps: the release-notes-generator plugin now expects to be used with the latest major
  versions of conventional-changelog packages. if you are installing any of these packages in addition
  to semantic-release, be sure to update them as well

v23.1.1

Compare Source

Bug Fixes

• deps: update dependency execa to v9 (#​3296) (73bcd0b)

v23.1.0

Compare Source

Features

• add main branch to default release branch config (#​1737) (95d8736)

v23.0.8

Compare Source

Bug Fixes

• deps: rename read-pkg-up -> read-package-up (4980cba)
• deps: rename read-pkg-up -> read-package-up (#​3249) (95a8b9e)

v23.0.7

Compare Source

Bug Fixes

• deps: update dependency find-versions to v6 (6a2b6bb)

v23.0.6

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/release-notes-generator to v13 (#​3237) (b7e08fc)

v23.0.5

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/commit-analyzer to v12 (#​3226) (29458a0)

v23.0.4

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/npm to v12 (#​3224) (7a50c8a)

v23.0.3

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/github to v10 (#​3222) (96d5aeb)

v23.0.2

Compare Source

Bug Fixes

• deps: update dependency marked to v12 (#​3176) (38105f5)

v23.0.1

Compare Source

Bug Fixes

• deps: update dependency marked-terminal to v7 (9faded8)

v23.0.0

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v9 (#​3105) (07dde04)
• deps: update dependency marked to v11 (#​3079) (6d2a6f1)
• deps: upgraded to the latest version of env-ci (0d0ed9d)
• use one note reference per tag to prevent conflicts (#​2085) (020ea7d)

Features

• node-versions: dropped support for node v18 and raised the minimum for v20 (2904832), closes /github.com/semantic-release/gitlab/pull/647#discussion_r1423131205

BREAKING CHANGES

• deps: woodpecker ci users need to upgrade to v1.0.0 or higher to remain supported. see
  https://github.com/semantic-release/env-ci/releases/tag/v11.0.0 for more information
• node-versions: support for node v18 has been dropped and the minimum for v20 is now v20.8.1

related to https://redirect.github.com/semantic-release/semantic-release/discussions/3088

• deps: if using release.config.js as the name of your config file, it needs to be moved to a .config/ directory or renamed to .releaserc.js to keep it in the root of the repository. see https://github.com/cosmiconfig/cosmiconfig/releases/tag/v9.0.0 for more detail

v22.0.12

Compare Source

Bug Fixes

• Revert "fix(deps): update dependency cosmiconfig to v9" (#​3104) (f6f1bf1)

v22.0.11

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v9 (b38cd2e)

v22.0.10

Compare Source

Bug Fixes

• revert updating cosmiconfig to v9 (88efead)

v22.0.9

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v9 (#​3072) (8b0dbd2)

v22.0.8

Compare Source

Bug Fixes

• support windows absolute extends (#​3062) (0d06f62)

v22.0.7

Compare Source

Bug Fixes

• deps: update dependency read-pkg-up to v11 (#​3047) (f09e55f)

Features

• support extending ESM configuration files (#​3036)(6900865)

v22.0.6

Compare Source

Bug Fixes

• deps: update dependency figures to v6 (#​3033) (305674d)

v22.0.5

Compare Source

Bug Fixes

• deps: update dependency env-ci to v10 (#​2983) (e759493)

v22.0.4

Compare Source

Bug Fixes

• deps: update dependency marked to v9 (#​2947) (84f2ee9)

v22.0.3

Compare Source

Bug Fixes

• exports: removed the exports definition for the time being (561e2d6), closes #​2968. see #​2978 for more information.

v22.0.2

Compare Source

Bug Fixes

• deps: update dependency marked-terminal to v6 (8a7befe)

v22.0.1

Compare Source

Bug Fixes

• deps: upgraded release-notes-generator and commit-analyzer plugins to stable versions (041e4f7), closes #​2934

v22.0.0

Compare Source

Bug Fixes

• deps: updated to the latest beta of the commit analyzer plugin (03a687b)
• deps: updated to the latest betas of the commit-analyzer and release-notes-generator plugins (de8e4e0)
• deps: upgraded to the latest version of the npm plugin with npm v10 (a23b718)

Features

• conventional-changelog-presets: supported new preset format (07a79ea)
• defined exports for the package (72ab317)
• node-versions: raised the minimum node v20 requirement to v20.6 (e623cc6)
• node-versions: raised the minimum required node version to v18.17 and dropped v19 support (b9f294d)
• node-versions: raised the minimum supported node version w/in the v20 range to v20.6.1 (b93bef4)

BREAKING CHANGES

• node-versions: the minimum supported version for the v20 range of node has been raised slightly to
  v20.6.1 to avoid a known node bug
• node-versions: the minimum supported node version in the v20 major range is now v20.6
• node-versions: node v18.17 is now the minimum supported node version and support for v19 has been dropped
• exports prevents access to internal files, but they arent intended for public use anyway
• conventional-changelog-presets: the new preset format is a breaking change when compared to the previous preset format. updating to support the new format means that the old preset format is no longer supported. update your preset to the latest version to maintain compatibility. this is also important if you are using a preset outside of the list of official conventional-changelog presets since your preset will need to be updated to export async functions to match the expected preset signature.

v21.1.2

Compare Source

Bug Fixes

• deps: update dependency aggregate-error to v5 (#​2956) (1017e1a)

v21.1.1

Compare Source

Bug Fixes

• types: included the definitions file in the published package (#​2920) (4c95c97)

v21.1.0

Compare Source

Features

• Added TypeScript definitions (#​2916) (c21a1ac)

v21.0.9

Compare Source

Bug Fixes

• deps: update dependency hosted-git-info to v7 (#​2908) (eba86ac)

v21.0.8

Compare Source

Bug Fixes

• deps: update dependency execa to v8 (#​2914) (7bc21fc)

v21.0.7

Compare Source

Bug Fixes

• deps: update dependency read-pkg-up to v10 (#​2862) (70996e0)

v21.0.6

Compare Source

Bug Fixes

• get correct version if prerelease branch shares version with ... (#​2416) (e4229f9)

v21.0.5

Compare Source

Bug Fixes

• deps: update dependency marked to v5 (452e1fa)

v21.0.4

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/error to v4 (d259350)

v21.0.3

Compare Source

Bug Fixes

• bump @semantic-release/commit-analyzer to v10.0.0-beta.1 (4a6b31f)
• bump @semantic-release/github to 9.0.0-beta.2 (#​2818) (6f19d77)
• deps: updated the beta plugins to stable versions (3941018)

v21.0.2

Compare Source

Bug Fixes

• deps: update dependency @​semantic-release/release-notes-generator to v11 (#​2778) (ac40804)

v21.0.1

Compare Source

Bug Fixes

• deps: update dependency env-ci to v9 (#​2757) (4bddb37)

v21.0.0

Compare Source

BREAKING CHANGES

• deps: the npm plugin has updated the npm dependency to v9
• legacy authentication using NPM_USERNAME and NPM_PASSWORD is no longer supported. Use NPM_TOKEN instead.

Bug Fixes

• deps: bump @semantic-release/npm to ^10.0.0 (d647433)

v20.1.3

Compare Source

Bug Fixes

• deps: update dependency execa to v7.1.1 (c38b53a)

v20.1.2

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v8.1.2 (fbede54)

v20.1.1

Compare Source

Bug Fixes

• deps: update dependency execa to v7 (#​2709) (31d9bfe)

v20.1.0

Compare Source

Features

• plugins: add support for loading ESM plugins (#​2688) (d170f73)

v20.0.4

Compare Source

Bug Fixes

• windows: fixed issues preventing execution from windows (#​2672) (5df624c)

v20.0.3

Compare Source

Reverts

• Revert "chore(deps): update dependency ava to v5.1.1" (#​2682) (914b0a2), closes #​2682

v20.0.2

Compare Source

Bug Fixes

• deps: update dependency semver-diff to v4 (#​1915) (cb45d27)

v20.0.1

Compare Source

Bug Fixes

• deps: update dependency cosmiconfig to v8 (f914c1e)
• deps: update dependency hosted-git-info to v6 (c4da008)

v20.0.0

Compare Source

BREAKING CHANGES

• esm: semantic-release is now ESM-only. since it is used through its own executable, the impact on consuming projects should be minimal
• esm: references to plugin files in configs need to include the file extension because of executing in an ESM context
• node-versions: node v18 is now the minimum required version of node. this is in line with our node support policy. please see our recommendations for releasing with a different node version than your project normally uses, if necessary.

Features

• esm: convert to esm (#​2569) (9eab1ad), closes #​2543
• node-versions: raised the minimum required node version to v18 (#​2620) (8a0d8be)

Bug Fixes

• env-ci: updated to the stable esm-only version (#​2632) (918eb59)
• secrets-masking: used the proper named import from hook-std to enable masking for stderr (#​2619) (cf6befa)

v19.0.5

Compare Source

Reverts

• Revert "fix(deps): update dependency yargs to v17" (#​2534) (8f07522), closes #​2534 #​2533

v19.0.4

Compare Source

Bug Fixes

• deps: update dependency yargs to v17 (#​1912) (f419080)

v19.0.3

Compare Source

Bug Fixes

• log-repo: use the original form of the repo url to remove the need to mask credentials (#​2459) (58a226f), closes #​2449

v19.0.2

Compare Source

Bug Fixes

• npm-plugin: upgraded to the stable version (0eca144)

v19.0.1

Compare Source

Bug Fixes

• npm-plugin: upgraded to the latest beta version (8097afb)

v19.0.0

Compare Source

Bug Fixes

• npm-plugin: upgraded to the beta, which upgrades npm to v8 (f634b8c)
• upgrade marked to resolve ReDos vulnerability (#​2330) (d9e5bc0)

BREAKING CHANGES

• npm-plugin: @semantic-release/npm has also dropped support for node v15
• node v15 has been removed from our defined supported versions of node. this was done to upgrade to compatible versions of marked and marked-terminal that resolved the ReDoS vulnerability. removal of support of this node version should be low since it was not an LTS version and has been EOL for several months already.

v18.0.1

Compare Source

Bug Fixes

• bump @​semantic-release/commit-analyzer to 9.0.2 (#​2258) (7f971f3)

v18.0.0

Compare Source

This is a maintenance release. An increasing amount of dependencies required a node version higher than the Node 10 version supported by semantic-release@17. We decided to go straight to a recent Node LTS version because the release build is usually independent of others, requiring a higher node version is less disruptive to users, but helps us reduce the maintenance overhead.

If you use GitHub Actions and need to bump the node version set up by actions/node-setup, you can use octoherd-script-bump-node-version-in-workflows

BREAKING CHANGES

node-version: the minimum required version of node is now v14.17

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.