diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ccf156b..8280b8b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -94,7 +94,7 @@ jobs: - run: pnpm exec playwright test --config=playwright.clean.config.ts - run: MUSTER_DEMO_MODE=true pnpm db:seed - run: pnpm exec playwright test tests/muster.spec.ts tests/jessie-hunt.spec.ts --project=chromium - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: name: playwright-report @@ -135,7 +135,7 @@ jobs: org.opencontainers.image.title=Muster org.opencontainers.image.description=Shared workspace for human and agent-driven security operations org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} - - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 + - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 id: build with: context: . @@ -144,16 +144,19 @@ jobs: platforms: linux/amd64 tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} - provenance: mode=max - sbom: true + provenance: ${{ github.event_name == 'push' && 'mode=max' || 'false' }} + sbom: ${{ github.event_name == 'push' }} cache-from: type=gha cache-to: type=gha,mode=max - name: Verify container starts if: github.event_name == 'pull_request' - run: docker image inspect "${REGISTRY}/${IMAGE_NAME}:sha-${GITHUB_SHA::7}" + shell: bash + run: | + image_ref="${REGISTRY}/${IMAGE_NAME,,}:sha-${GITHUB_SHA::7}" + docker image inspect "$image_ref" - name: Attest published image if: github.event_name == 'push' - uses: actions/attest@36051bcae73b7c2a8a6945a48cbf80953c6baa35 # v4 + uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4 with: subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} subject-digest: ${{ steps.build.outputs.digest }} diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index d8efd21..d4217f6 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -16,10 +16,10 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - - uses: github/codeql-action/init@adfda868f108ac4222129de456ea554034a27db7 # v4 + - uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 with: languages: javascript-typescript - - uses: github/codeql-action/analyze@adfda868f108ac4222129de456ea554034a27db7 # v4 + - uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4 dependencies-and-secrets: runs-on: ubuntu-24.04 @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - - uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2 + - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4 @@ -43,7 +43,7 @@ jobs: run: | pnpm licenses list --prod --json | tee licenses.json ! grep -E '"(AGPL|SSPL)' licenses.json - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: dependency-licences path: licenses.json @@ -53,7 +53,7 @@ jobs: steps: - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 - - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 + - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . load: true @@ -78,7 +78,7 @@ jobs: printf '{"commit":"%s","workflow":"%s","runId":"%s","image":"muster:security"}\n' \ "$GITHUB_SHA" "$GITHUB_WORKFLOW" "$GITHUB_RUN_ID" > provenance.json sha256sum muster-sbom.cdx.json provenance.json > SHA256SUMS - - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: security-artifacts path: | diff --git a/apps/web/package.json b/apps/web/package.json index bd3df1d..0171c41 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -35,7 +35,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "drizzle-orm": "0.45.2", - "ioredis": "5.8.2", + "ioredis": "5.11.1", "lucide-react": "1.27.0", "next": "16.2.12", "radix-ui": "^1.4.3", diff --git a/packages/auth/package.json b/packages/auth/package.json index 55ddb40..a0fc7bf 100644 --- a/packages/auth/package.json +++ b/packages/auth/package.json @@ -26,7 +26,7 @@ "@better-auth/passkey": "1.6.25", "@muster/database": "workspace:*", "better-auth": "1.6.25", - "nodemailer": "9.0.1" + "nodemailer": "9.0.3" }, "devDependencies": { "@types/nodemailer": "^7.0.1", diff --git a/packages/database/package.json b/packages/database/package.json index cda7c19..9b67978 100644 --- a/packages/database/package.json +++ b/packages/database/package.json @@ -36,7 +36,7 @@ "@muster/contracts": "workspace:*", "drizzle-orm": "0.45.2", "pg": "^8.16.3", - "uuid": "^13.0.0", + "uuid": "14.0.1", "zod": "4.4.3" }, "devDependencies": { diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 3f6a5d4..2d95cb5 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -153,8 +153,8 @@ importers: specifier: 0.45.2 version: 0.45.2(@types/pg@8.20.0)(kysely@0.29.4)(pg@8.22.0) ioredis: - specifier: 5.8.2 - version: 5.8.2 + specifier: 5.11.1 + version: 5.11.1 lucide-react: specifier: 1.27.0 version: 1.27.0(react@19.2.8) @@ -332,8 +332,8 @@ importers: specifier: 1.6.25 version: 1.6.25(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@types/pg@8.20.0)(kysely@0.29.4)(pg@8.22.0))(next@16.2.12(@playwright/test@1.62.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(pg@8.22.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@types/node@24.13.3)(vite@8.1.5(@types/node@24.13.3)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.23.1)(yaml@2.9.0))) nodemailer: - specifier: 9.0.1 - version: 9.0.1 + specifier: 9.0.3 + version: 9.0.3 devDependencies: '@types/nodemailer': specifier: ^7.0.1 @@ -404,8 +404,8 @@ importers: specifier: ^8.16.3 version: 8.22.0 uuid: - specifier: ^13.0.0 - version: 13.0.2 + specifier: 14.0.1 + version: 14.0.1 zod: specifier: 4.4.3 version: 4.4.3 @@ -1350,9 +1350,6 @@ packages: '@ioredis/commands@1.10.0': resolution: {integrity: sha512-UmeW7z4LfctwoQ5wkhVzgq8tXkreED2xZGpX+Bg+zA+WJFZCT6c062AfCK/Dfk81xZnnwdhJCUMkitihRaoC2Q==} - '@ioredis/commands@1.4.0': - resolution: {integrity: sha512-aFT2yemJJo+TZCmieA7qnYGQooOS7QfNmYrzGtsYd3g9j5iDP8AimYYAesf79ohjbLG12XxC4nG5DyEnC88AsQ==} - '@jridgewell/gen-mapping@0.3.13': resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==} @@ -3266,10 +3263,6 @@ packages: resolution: {integrity: sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==} engines: {node: '>=12.22.0'} - ioredis@5.8.2: - resolution: {integrity: sha512-C6uC+kleiIMmjViJINWk80sOQw5lEzse1ZmvD+S/s8p8CWapftSaC+kocGTx6xrbrJ4WmYQGC08ffHLr6ToR6Q==} - engines: {node: '>=12.22.0'} - jiti@2.7.0: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} hasBin: true @@ -3432,12 +3425,6 @@ packages: linkifyjs@4.3.3: resolution: {integrity: sha512-P8aEP5U/D1/IlTY2OeYsErdwh9bGuLE30NcXtKEjgdHcahveQoQwM2yZNsioQHsWFz0P7KKudisbrzCgR0sDHg==} - lodash.defaults@4.2.0: - resolution: {integrity: sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==} - - lodash.isarguments@3.1.0: - resolution: {integrity: sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==} - lucide-react@1.27.0: resolution: {integrity: sha512-rJicGl/3Fly/E0rOH1YmPZ6e49JCnKknh1ox1vpHnkfjujAkKA6sqUZvH3MTAaXXjgexyUwgNwTJzTtYuAFYJw==} peerDependencies: @@ -3497,10 +3484,6 @@ packages: resolution: {integrity: sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw==} hasBin: true - nodemailer@9.0.1: - resolution: {integrity: sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==} - engines: {node: '>=6.0.0'} - nodemailer@9.0.3: resolution: {integrity: sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==} engines: {node: '>=6.0.0'} @@ -3883,8 +3866,8 @@ packages: peerDependencies: react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 - uuid@13.0.2: - resolution: {integrity: sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==} + uuid@14.0.1: + resolution: {integrity: sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==} hasBin: true victory-vendor@37.3.6: @@ -4454,8 +4437,6 @@ snapshots: '@ioredis/commands@1.10.0': {} - '@ioredis/commands@1.4.0': {} - '@jridgewell/gen-mapping@0.3.13': dependencies: '@jridgewell/sourcemap-codec': 1.5.5 @@ -6236,20 +6217,6 @@ snapshots: transitivePeerDependencies: - supports-color - ioredis@5.8.2: - dependencies: - '@ioredis/commands': 1.4.0 - cluster-key-slot: 1.1.1 - debug: 4.4.3 - denque: 2.1.0 - lodash.defaults: 4.2.0 - lodash.isarguments: 3.1.0 - redis-errors: 1.2.0 - redis-parser: 3.0.0 - standard-as-callback: 2.1.0 - transitivePeerDependencies: - - supports-color - jiti@2.7.0: {} jose@6.2.4: {} @@ -6356,10 +6323,6 @@ snapshots: linkifyjs@4.3.3: {} - lodash.defaults@4.2.0: {} - - lodash.isarguments@3.1.0: {} - lucide-react@1.27.0(react@19.2.8): dependencies: react: 19.2.8 @@ -6424,8 +6387,6 @@ snapshots: detect-libc: 2.1.2 optional: true - nodemailer@9.0.1: {} - nodemailer@9.0.3: {} obug@2.1.4: {} @@ -6898,7 +6859,7 @@ snapshots: dependencies: react: 19.2.8 - uuid@13.0.2: {} + uuid@14.0.1: {} victory-vendor@37.3.6: dependencies: