fix(deps): update dependency @octokit/plugin-paginate-rest to v9 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@octokit/plugin-paginate-rest	^6.1.2 → ^9.0.0

GitHub Vulnerability Alerts

CVE-2025-25288

Summary

For the npm package @octokit/plugin-paginate-rest, when calling octokit.paginate.iterator(), a specially crafted octokit instance—particularly with a malicious link parameter in the headers section of the request—can trigger a ReDoS attack.

Details

The issue occurs at line 39 of iterator.ts in the @​octokit/plugin-paginate-rest repository. The relevant code is as follows:

url = ((normalizedResponse.headers.link || "").match(
  /<([^>]+)>;\s*rel="next"/,
) || [])[1];

The regular expression /<([^>]+)>;\s*rel="next"/ may lead to a potential backtracking vulnerability, resulting in a ReDoS (Regular Expression Denial of Service) attack. This could cause high CPU utilization and even service slowdowns or freezes when processing specially crafted Link headers.

PoC

The gist of PoC.js

1. run npm i @​octokit/plugin-paginate-rest
2. run 'node poc.js'
   result:
3. then the program will stuck forever with high CPU usage

import { Octokit } from "@​octokit/core";
import { paginateRest } from "@​octokit/plugin-paginate-rest";

const MyOctokit = Octokit.plugin(paginateRest);
const octokit = new MyOctokit({
  auth: "your-github-token",
});

// Intercept the request to inject a malicious 'link' header for ReDoS
octokit.hook.wrap("request", async (request, options) => {
  const maliciousLinkHeader = "" + "<".repeat(100000) + ">"; // attack string
  return {
    data: [],
    headers: {
      link: maliciousLinkHeader, // Inject malicious 'link' header
    },
  };
});

// Trigger the ReDoS attack by paginating through GitHub issues
(async () => {
  try {
    for await (const normalizedResponse of octokit.paginate.iterator(
      "GET /repos/{owner}/{repo}/issues", { owner: "DayShift", repo: "ReDos", per_page: 100 }
    )) {
      console.log({ normalizedResponse });
    }
  } catch (error) {
    console.error("Error encountered:", error);
  }
})();

Impact

What kind of vulnerability is it?

This is a Regular Expression Denial of Service (ReDoS) vulnerability, which occurs due to excessive backtracking in the regex pattern:

/<([^>]+)>;\s*rel="next"/

When processing a specially crafted Link header, this regex can cause significant performance degradation, leading to high CPU utilization and potential service unresponsiveness.

Who is impacted?

• Users of @octokit/plugin-paginate-rest who call octokit.paginate.iterator() and process untrusted or manipulated Link headers.
• Applications relying on Octokit's pagination mechanism, particularly those handling large volumes of API requests.
• GitHub API consumers who integrate this package into their projects for paginated data retrieval.

---

Release Notes

octokit/plugin-paginate-rest.js (@​octokit/plugin-paginate-rest)

v9.2.2

Compare Source

Bug Fixes

• ReDos regex vulnerability, reported by @​DayShift (#​660) (e1e4489)

v9.2.1

Compare Source

Bug Fixes

• pkg: pin @octokit/core peerDependency to v5 (#​599) (5b84386)

v9.2.0

Compare Source

Features

• new /orgs/{org}/organization-roles/{role_id}/teams and /orgs/{org}/organization-roles/{role_id}/users endpoints (#​594) (75aeaaf)

v9.1.5

Compare Source

Bug Fixes

• bump octokit/types minor version (#​581) (65baec4)

v9.1.4

Compare Source

Bug Fixes

• deps: bump @octokit/types (#​575) (27db9ae)

v9.1.3

Compare Source

Bug Fixes

• deps: bump @octokit/types (#​574) (0940cb7)

v9.1.2

Compare Source

Bug Fixes

• bump octokit/types version (#​573) (30749f7)

v9.1.1

Compare Source

Bug Fixes

• example payload updates (#​572) (2bce981)

v9.1.0

Compare Source

Features

• new GET /orgs/{org}/properties/values, GET /orgs/{org}/rulesets/rule-suites, GET /repos/{owner}/{repo}/rulesets/rule-suites endpoints (#​569) (4b8d674)

v9.0.0

Compare Source

Features

• new GitHub advisories, new GitHub classroom endpoints, new copilot endpoints, remove required workflow endpoints (#​563) (17ad591)

BREAKING CHANGES

• remove required workflow endpoints

v8.0.0

Compare Source

chore

• deps: update octokit monorepo (major) (#​541) (25c86b9)

BREAKING CHANGES

• deps: Bump peerDependency of @octokit/core to v5
• deps: Bump @octokit/types to v11

v7.1.2

Compare Source

Bug Fixes

• deps: update dependency @​octokit/tsconfig to v2 (#​532) (0d84417)
• explicitly mark type imports and exports (#​540) (b943e50)

v7.1.1

Compare Source

Bug Fixes

• bump @​octokit/types version (#​536) (adbe3b9)

v7.1.0

Compare Source

Features

• new endpoints for rulesets, update template to use type imports (#​533) (ac4adf5)

v7.0.0

Compare Source

Continuous Integration

• stop testing against NodeJS v14, v16 (#​524) (07856e8)

BREAKING CHANGES

• Drop support for NodeJS v14, v16

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
ckb-explorer-website	Ready	Preview	Comment	Oct 21, 2025 11:45am
magickbase-website	Ready	Preview	Comment	Oct 21, 2025 11:45am
status-website	Ready	Preview	Comment	Oct 21, 2025 11:45am

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
neuron-website	Ignored	Preview		Oct 21, 2025 11:45am

💡 Enable Vercel Agent with $100 free credit for automated AI reviews