Skip to content

chore(security): close dependabot alerts q2 #3456

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nicktrn merged 15 commits into from
Apr 28, 2026
Merged

chore(security): close dependabot alerts q2 #3456

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
bb71ea2
chore(security): bump vite to 6.4.2 via override + drop unused root d…
nicktrn Apr 27, 2026
ea1d339
chore(security): dev-only overrides for rollup, flatted, picomatch, m…
nicktrn Apr 27, 2026
3d2eae5
chore(security): override protobufjs + fast-xml-parser for critical CVEs
nicktrn Apr 27, 2026
e02e0de
chore(security): bump existing overrides + dompurify direct dep
nicktrn Apr 27, 2026
4688261
chore: bump testcontainers + rimraf in dev/test deps
nicktrn Apr 27, 2026
9ef38cf
chore(security): bump nodemailer 7 -> 8 for CRLF injection CVE
nicktrn Apr 27, 2026
2409635
chore(security): bump uuid 9 -> 14 in webapp; drop unused uuid dep fr…
nicktrn Apr 27, 2026
0bddd77
chore(security): bump tar in cli-v3 + override for supervisor k8s chain
nicktrn Apr 27, 2026
3ca8f9f
chore(security): override path-to-regexp 0.1.x for express 4 ReDoS
nicktrn Apr 27, 2026
c5f2171
chore(security): tighten override matchers + add ajv/socket.io-parser…
nicktrn Apr 27, 2026
47edc25
chore(security): bump effect 3.11 -> 3.21 in webapp for AsyncLocalSto…
nicktrn Apr 27, 2026
5146f79
chore: regenerate lockfile for minimal diff against main
nicktrn Apr 27, 2026
78bd3b9
fix(testcontainers): convert stop() timeouts to ms for v11 + drop sta…
nicktrn Apr 27, 2026
fb4e16b
fix(webapp): bundle uuid in remix server build + drop redundant @type…
nicktrn Apr 27, 2026
92eb872
chore(security): tighten lodash override lower bound to 4.17
nicktrn Apr 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions apps/webapp/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -147,9 +147,9 @@
"cross-env": "^7.0.3",
"cuid": "^2.1.8",
"date-fns": "^4.1.0",
"dompurify": "^3.2.6",
"dompurify": "^3.4.1",
"dotenv": "^16.4.5",
"effect": "^3.11.7",
"effect": "^3.21.2",
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment thread
nicktrn marked this conversation as resolved.
"emails": "workspace:*",
"eventsource": "^4.0.0",
"evt": "^2.4.13",
Expand Down Expand Up @@ -227,7 +227,7 @@
"tiny-invariant": "^1.2.0",
"ulid": "^2.3.0",
"ulidx": "^2.2.1",
"uuid": "^9.0.0",
"uuid": "^14.0.0",
Comment thread
coderabbitai[bot] marked this conversation as resolved.
"ws": "^8.11.0",
"zod": "3.25.76",
"zod-error": "1.5.0",
Expand All @@ -249,7 +249,6 @@
"@types/bcryptjs": "^2.4.2",
"@types/compression": "^1.7.2",
"@types/cookie": "^0.6.0",
"@types/dompurify": "^3.2.0",
"@types/eslint": "^8.4.6",
"@types/express": "^4.17.13",
"@types/humanize-duration": "^3.27.1",
Expand All @@ -270,7 +269,6 @@
"@types/slug": "^5.0.3",
"@types/supertest": "^6.0.2",
"@types/tar": "^6.1.4",
"@types/uuid": "^9.0.0",
"@types/ws": "^8.5.3",
"@typescript-eslint/eslint-plugin": "^5.59.6",
"@typescript-eslint/parser": "^5.59.6",
Expand All @@ -292,7 +290,7 @@
"prettier": "^2.8.8",
"prettier-plugin-tailwindcss": "^0.3.0",
"prop-types": "^15.8.1",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"style-loader": "^3.3.4",
"supertest": "^7.0.0",
"tailwind-scrollbar": "^3.0.1",
Expand Down
1 change: 1 addition & 0 deletions apps/webapp/remix.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ module.exports = {
"parse-duration",
"uncrypto",
"std-env",
"uuid",
],
browserNodeBuiltinsPolyfill: {
modules: {
Expand Down
4 changes: 2 additions & 2 deletions internal-packages/emails/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,15 @@
"@aws-sdk/client-sesv2": "^3.716.0",
"@react-email/components": "0.0.16",
"@react-email/render": "^0.0.12",
"nodemailer": "^7.0.11",
"nodemailer": "^8.0.6",
"react": "^18.2.0",
"react-email": "^2.1.1",
"resend": "^3.2.0",
"tiny-invariant": "^1.2.0",
"zod": "3.25.76"
},
"devDependencies": {
"@types/nodemailer": "^7.0.4",
"@types/nodemailer": "^8.0.0",
"@types/react": "18.2.69"
},
"engines": {
Expand Down
2 changes: 1 addition & 1 deletion internal-packages/otlp-importer/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@
},
"devDependencies": {
"@types/node": "^20",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"ts-proto": "^1.167.3"
},
"engines": {
Expand Down
6 changes: 3 additions & 3 deletions internal-packages/testcontainers/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,11 @@
"ioredis": "^5.3.2"
},
"devDependencies": {
"@testcontainers/postgresql": "^10.28.0",
"@testcontainers/redis": "^10.28.0",
"@testcontainers/postgresql": "^11.14.0",
"@testcontainers/redis": "^11.14.0",
"@trigger.dev/core": "workspace:*",
"std-env": "^3.9.0",
"testcontainers": "^10.28.0",
"testcontainers": "^11.14.0",
Comment thread
coderabbitai[bot] marked this conversation as resolved.
"tinyexec": "^0.3.0"
},
"scripts": {
Expand Down
10 changes: 6 additions & 4 deletions internal-packages/testcontainers/src/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,9 @@ export async function createRedisContainer({
port?: number;
network?: StartedNetwork;
}) {
let container = new RedisContainer().withExposedPorts(port ?? 6379).withStartupTimeout(120_000); // 2 minutes
let container = new RedisContainer("redis:7.2")
.withExposedPorts(port ?? 6379)
.withStartupTimeout(120_000); // 2 minutes

if (network) {
container = container.withNetwork(network).withNetworkAliases("redis");
Expand All @@ -97,7 +99,7 @@ export async function createRedisContainer({
const [error] = await tryCatch(verifyRedisConnection(startedContainer));

if (error) {
await startedContainer.stop({ timeout: 30 });
await startedContainer.stop({ timeout: 30_000 });
throw new Error("verifyRedisConnection error", { cause: error });
}

Expand Down Expand Up @@ -236,7 +238,7 @@ export async function useContainer<TContainer extends StartedTestContainer>(
metadata.useDurationMs = useDurationMs;
} finally {
// WARNING: Testcontainers by default will not wait until the container has stopped. It will simply issue the stop command and return immediately.
// If you need to wait for the container to be stopped, you can provide a timeout. The unit of timeout option here is second
await logCleanup(name, container.stop({ timeout: 10 }), metadata);
// If you need to wait for the container to be stopped, you can provide a timeout. The unit of timeout option here is milliseconds (changed from seconds in testcontainers v11)
await logCleanup(name, container.stop({ timeout: 10_000 }), metadata);
}
}
27 changes: 22 additions & 5 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,6 @@
"tsx": "^3.7.1",
"turbo": "^1.10.3",
"typescript": "5.5.4",
"vite": "^5.4.21",
"vite-tsconfig-paths": "^4.0.5",
"vitest": "3.1.4"
},
Expand Down Expand Up @@ -90,17 +89,35 @@
"@types/node": "20.14.14",
"express@^4>body-parser": "1.20.3",
"@remix-run/dev@2.17.4>tar-fs": "2.1.4",
"testcontainers@10.28.0>tar-fs": "3.1.1",
"tar@>=7 <7.5.11": "^7.5.11",
"form-data@^2": "2.5.4",
"form-data@^3": "3.0.4",
"form-data@^4": "4.0.4",
"axios@1.9.0": ">=1.12.0",
"axios@>=1.0.0 <1.15.0": "^1.15.0",
"js-yaml@>=3.0.0 <3.14.2": "3.14.2",
"js-yaml@>=4.0.0 <4.1.1": "4.1.1",
"jws@<3.2.3": "3.2.3",
"qs@>=6.0.0 <6.14.1": "6.14.1",
"systeminformation@>=5.0.0 <5.27.14": "5.27.14",
"lodash@>=4.0.0 <4.17.23": "4.17.23"
"systeminformation@>=5.0.0 <5.31.0": "^5.31.0",
"lodash@>=4.17 <4.18.0": "^4.18.0",
"lodash-es@>=4.17 <4.18.0": "^4.18.0",
Comment thread
nicktrn marked this conversation as resolved.
"dompurify@>=3 <3.4.0": "^3.4.1",
"vite@>=5.0.0 <6.4.2": "^6.4.2",
Comment thread
nicktrn marked this conversation as resolved.
"rollup@>=4 <4.59.0": "^4.59.0",
"flatted@>=3 <3.4.2": "^3.4.2",
"picomatch@>=2 <2.3.2": "^2.3.2",
"picomatch@>=4 <4.0.4": "^4.0.4",
"minimatch@>=3 <3.1.3": "^3.1.3",
"protobufjs@>=7 <7.5.5": "^7.5.5",
"fast-xml-parser@>=4 <4.5.5": "^4.5.5",
"fast-xml-parser@>=5 <5.7.0": "^5.7.0",
"path-to-regexp@>=0.1 <0.1.13": "^0.1.13",
"ajv@>=8 <8.18.0": "^8.18.0",
"socket.io-parser@>=4 <4.2.6": "^4.2.6",
"postcss@>=8 <8.5.10": "^8.5.10",
"yaml@>=2 <2.8.3": "^2.8.3",
"semver@>=5 <5.7.2": "^5.7.2",
"defu@>=6 <6.1.5": "^6.1.5"
Comment thread
nicktrn marked this conversation as resolved.
},
"onlyBuiltDependencies": [
"@depot/cli",
Expand Down
4 changes: 2 additions & 2 deletions packages/cli-v3/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@
"cpy-cli": "^5.0.0",
"execa": "^8.0.1",
"find-up": "^7.0.0",
"rimraf": "^5.0.7",
"rimraf": "^6.0.1",
"ts-essentials": "10.0.1",
"tshy": "^3.0.2",
"tsx": "4.17.0"
Expand Down Expand Up @@ -140,7 +140,7 @@
"std-env": "^3.7.0",
"strip-ansi": "^7.1.0",
"supports-color": "^10.0.0",
"tar": "^7.5.4",
"tar": "^7.5.13",
"tiny-invariant": "^1.2.0",
"tinyexec": "^0.3.1",
"tinyglobby": "^0.2.10",
Expand Down
2 changes: 1 addition & 1 deletion packages/core/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@
"ai": "^6.0.0",
"defu": "^6.1.4",
"esbuild": "^0.23.0",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"superjson": "^2.2.1",
"ts-essentials": "10.0.1",
"tshy": "^3.0.2",
Expand Down
2 changes: 1 addition & 1 deletion packages/react-hooks/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
"@arethetypeswrong/cli": "^0.15.4",
"@types/react": "*",
"@types/react-dom": "*",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"tshy": "^3.0.2",
"tsx": "4.17.0"
},
Expand Down
2 changes: 1 addition & 1 deletion packages/rsc/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
"@types/node": "^20.14.14",
"@types/react": "*",
"@types/react-dom": "*",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"tshy": "^3.0.2",
"tsx": "4.17.0"
},
Expand Down
4 changes: 1 addition & 3 deletions packages/trigger-sdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,18 +60,16 @@
"slug": "^6.0.0",
"ulid": "^2.3.0",
"uncrypto": "^0.1.3",
"uuid": "^9.0.0",
"ws": "^8.11.0"
},
"devDependencies": {
"@arethetypeswrong/cli": "^0.15.4",
"@types/debug": "^4.1.7",
"@types/slug": "^5.0.3",
"@types/uuid": "^9.0.0",
"@types/ws": "^8.5.3",
"ai": "^6.0.0",
"encoding": "^0.1.13",
"rimraf": "^3.0.2",
"rimraf": "^6.0.1",
"tshy": "^3.0.2",
"tsx": "4.17.0",
"typed-emitter": "^2.1.0",
Expand Down
Loading
Loading