Skip to content

fix(memCache): disallow http requests in cache to be mutable#35647

Merged
rarkins merged 1 commit intorenovatebot:mainfrom
felipecrs:fix-mutable-http-cache
Apr 30, 2025
Merged

fix(memCache): disallow http requests in cache to be mutable#35647
rarkins merged 1 commit intorenovatebot:mainfrom
felipecrs:fix-mutable-http-cache

Conversation

@felipecrs
Copy link
Copy Markdown
Contributor

Changes

Fixes an issue with the memoery http cache provider where the cached http reponses could be mutated after being read from the cache.

This could cause several unexected issues, like returning a cache hit with a different body than the one that was cached.

So far, only the Gerrit platform was identified as being affected by this issue.

Context

Documentation (please check one with an [x])

  • I have updated the documentation, or
  • No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

  • Code inspection only, or
  • Newly added/modified unit tests, or
  • No unit tests but ran on a real repository, or
  • Both unit tests + ran on a real repository

@rarkins rarkins requested a review from zharinov April 30, 2025 15:00
@rarkins rarkins requested a review from viceice April 30, 2025 15:14
Copy link
Copy Markdown
Member

@viceice viceice left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this causes performance, not sure if it's measurable. 🤔

@rarkins rarkins added this pull request to the merge queue Apr 30, 2025
@felipecrs
Copy link
Copy Markdown
Contributor Author

felipecrs commented Apr 30, 2025

this causes performance, not sure if it's measurable. 🤔

Yeah, but the side effect without it is a lot worse.

Merged via the queue into renovatebot:main with commit 6068a59 Apr 30, 2025
40 checks passed
@felipecrs felipecrs deleted the fix-mutable-http-cache branch April 30, 2025 15:57
@renovate-release
Copy link
Copy Markdown

🎉 This PR is included in version 40.0.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

SuperSandro2000 added a commit to SuperSandro2000/renovate that referenced this pull request May 1, 2025
* upstream/main: (176 commits)
  build(deps): update aws-sdk-js-v3 monorepo (main) (renovatebot#35660)
  chore(deps): update docker/dockerfile docker tag to v1.15.1 (main) (renovatebot#35659)
  fix(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.3 (main) (renovatebot#35657)
  chore: thre -> the (renovatebot#35655)
  chore(deps): update dependency vite to v6.3.4 [security] (main) (renovatebot#35653)
  build(deps): update dependency glob to v11.0.2 (main) (renovatebot#35649)
  fix(memCache): disallow http requests in cache to be mutable (renovatebot#35647)
  fix(gomod): Exclude multi-line `exclude` directives from extraction (renovatebot#35623)
  docs(config options): rewrite `ignoreScripts` (renovatebot#32171)
  chore(deps): update python:3.13 docker digest to 884da97 (main) (renovatebot#35645)
  chore(deps): update python docker tag to v3.13.3 (main) (renovatebot#35276)
  fix(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.2 (main) (renovatebot#35644)
  feat(config)!: validate allowedCommands against post-compiled commands (renovatebot#35564)
  feat(config)!: create new Config Warning issues each time (renovatebot#35565)
  feat(autodiscoverFilter)!: support combined negative matches (renovatebot#34707)
  feat(datasource/maven)!: use latest and release values as tags (renovatebot#35515)
  feat!: require node v22.13 (renovatebot#34524)
  chore(deps): update dependency esbuild to v0.25.3 (main) (renovatebot#35637)
  chore(deps): update python:3.13 docker digest to 19c3e96 (main) (renovatebot#35636)
  feat(deps): update ghcr.io/renovatebot/base-image docker tag to v9.64.1 (main) (renovatebot#35632)
  ...
@github-actions github-actions Bot locked as resolved and limited conversation to collaborators May 31, 2025
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants