Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge upstream changes #8

Merged
merged 16 commits into from Feb 17, 2021
Merged

Merge upstream changes #8

merged 16 commits into from Feb 17, 2021

Conversation

ghengeveld
Copy link
Member

@ghengeveld ghengeveld commented Jan 22, 2021

This makes our fork up-to-date with the latest changes from localtunnel/localtunnel.

The following modifications remain:

  • Accept body.cachedUrl (which the Chromatic localtunnel server provides) as alternative to body.cached_url (which localtunnel accepts by default). We have to update our localtunnel server to pass cached_url besides cachedUrl, so that we can drop this modification.
  • Accept process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0' as alternative to the allow_invalid_cert option. We may be able to pass this option in the CLI based on the env var in order to drop this modification.

@tmeasday
Copy link
Member

Accept body.cachedUrl (which the Chromatic localtunnel server provides) as alternative to body.cached_url (which localtunnel accepts by default). We have to update our localtunnel server to pass cached_url besides cachedUrl, so that we can drop this modification.

Our server doesn't current use this (AFAIK). We just want to ensure we can deploy a new version of our tunnel which does (and relies on it) without needing to wait for our users to upgrade their package. So I'd be OK with dropping this part.

Accept process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0' as alternative to the allow_invalid_cert option. We may be able to pass this option in the CLI based on the env var in order to drop this modification.

Sounds like something we could do easily enough I guess?

@Frozenfire92
Copy link

Frozenfire92 commented Feb 16, 2021

Noting that merging this (and releasing) should solve this vulnerability (from using an old version of yargs which has the vulnerable y18n) tangentially related: yargs/y18n#112

@ghengeveld ghengeveld merged commit 0c5963e into master Feb 17, 2021
@ghengeveld ghengeveld deleted the update-upstream branch February 17, 2021 10:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
6 participants