chore(deps): update dependency semantic-release to v17.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semantic-release	17.1.1 → 17.2.3

---

Secret disclosure when containing characters that become URI encoded

CVE-2020-26226 / GHSA-r2j6-p67h-q639

More information

Details

Impact

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL.

Patches

Fixed in v17.2.3

Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

Severity

• CVSS Score: 8.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639
• https://nvd.nist.gov/vuln/detail/CVE-2020-26226
• https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a
• https://github.com/advisories/GHSA-r2j6-p67h-q639

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

semantic-release/semantic-release (semantic-release)

v17.2.3

Compare Source

Bug Fixes

• mask secrets when characters get uri encoded (ca90b34)

v17.2.2

Compare Source

Bug Fixes

• don't parse port as part of the path in repository URLs (#​1671) (77a75f0)
• use valid git credentials when multiple are provided (#​1669) (2bf3771)

v17.2.1

Compare Source

Reverts

• Revert "feat: throw an Error if package.json has duplicate "repository" key (#​1656)" (3abcbaf), closes #​1656 #​1657

v17.2.0

Compare Source

Features

• throw an Error if package.json has duplicate "repository" key (#​1656) (b8fb35c)

v17.1.2

Compare Source

Bug Fixes

• add logging for when ssh falls back to http (#​1639) (b4c5d0a)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.