[ Release 2025-08-05 ] Full Security Remediation, Dependency Overhaul, Credential Infrastructure, and Sidekick Enhancements - #448
Merged
Merged
Conversation
…sting production settings
…AAI-490) - Add QuickSetup mode to credential checker hook for proactive credential setup - Implement extractAllCredentials function to show both assigned and unassigned credentials - Add QuickSetup parameter support in chat page and modal components - Integrate theme provider in AppProvider for consistent modal styling - Add flowData support in chat page for credential checking - Clean up console.log statements and improve code organization - Update .gitignore to exclude TypeScript build info files This feature enables users to quickly configure credentials when first accessing a Sidekick, improving onboarding experience and reducing friction. fix: resolve circular dependency and credential saving issues in useCredentialChecker hook fix: implement proper credential saving logic and notification system in ChatDetail refactor: clean up comments and improve code readability in UnifiedCredentialsModal refactor: improve QuickSetup modal code quality and user experience - Fix TypeScript typing by removing unsafe type casting in ChatDetail - Optimize credential loading to use specific API endpoints instead of filtering all credentials - Standardize error notifications using proper notification system instead of alerts - Improve navigation timing by replacing hard-coded delays with requestAnimationFrame - Add comprehensive loading states with disabled controls and loading indicators - Fix React warning by adding shouldForwardProp to filter custom props in styled components - Remove debug console.log statements from AddEditCredentialDialog for cleaner output - Enhance modal UX with better feedback during credential operations fix: restore accidentally removed code from UnifiedCredentialsModal - Restore renderCredentialRow function that was incorrectly removed - Restore keySVG import for fallback credential icons - Restore Divider import for UI components - Restore original variable names (theme, flowData, groupKey) - Keep legitimate improvements: loading states, error handling, API optimization refactor: extract credential management to reusable SidekickSetupModal component Based on PR #421 feedback, refactored credential management into a self-contained, reusable component: - Created useSidekickWithCredentials hook using SWR for data fetching - Created SidekickSetupModal component that accepts only sidekickId and onComplete props - Removed 130+ lines of credential logic from ChatDetail.tsx - Cleaned up redundant theme providers in AppProvider.jsx - Removed QuickSetup handling from Modal.tsx - Removed unnecessary flowData from page.tsx - Leveraged existing credential extraction utilities (extractMissingCredentials, extractAllCredentials) - Used updateFlowDataWithCredentials helper for applying credential assignments The component is now reusable across multiple entry points (chat, marketplace, extension). 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> feat: enhance Sidekick credential management and UI components - Integrated AppLayout in ChatUILayout for improved structure - Added SidekickSetupModal to handle credential setup in ChatDetail - Updated useCredentialChecker and useSidekickWithCredentials hooks for better credential management - Implemented missing credentials extraction utility for sidekicks - Enhanced SidekickCard and AssistantInfoCard with validation status indicators - Refactored various components for improved readability and performance This update streamlines the credential management process and enhances user experience across the application. refactor: update sidekick details fetching mechanism and improve hooks - Replaced legacy useSidekickDetails with a new useSidekickFetcher for better data handling - Updated useCredentialChecker and useSidekickWithCredentials hooks to utilize the new fetching method - Enhanced SidekickCard component to align with the new fetching logic - Improved loading state management in useSidekickWithCredentials These changes streamline the data fetching process and enhance the overall performance of sidekick-related components. refactor: migrate useSidekickDetails to pure SWR implementation - Remove backward compatibility code from useSidekickDetails - Update useSidekickWithCredentials to use SWR directly - Simplify fetcher to use axios for consistency - Maintain all original functionality and API endpoints refactor: enable chatbotConfig and flowData parsing in findSidekickById - Reintroduced parsing for chatbotConfig and flowData in the findSidekickById function - Ensured that the function now correctly processes these properties for improved data handling This update enhances the functionality of the findSidekickById utility, aligning it with recent changes in data fetching mechanisms. feat: enhance Sidekick setup and credential management UI - Added QuickSetup handling in SidekickSetupModal to reset skipped status based on setup type - Integrated needsSetup status in CanvasHeader and AssistantInfoCard for improved user feedback - Implemented UI indicators for credential configuration status in CanvasHeader - Updated ChatDetail to manage QuickSetup URL parameters for seamless navigation These changes improve the user experience by providing clearer indications of setup requirements and streamlining the credential management process across components. feat: enhance Sidekick setup functionality with QuickSetup support - Added QuickSetup parameter handling in findSidekickById to streamline sidekick initialization - Updated SidekickSetupModal to manage URL cleanup and state reset based on QuickSetup status - Improved credential fetching logic in useSidekickWithCredentials to support QuickSetup mode - Enhanced UI components to reflect QuickSetup state and provide better user feedback These changes improve the user experience by allowing for a more flexible sidekick setup process and clearer indications of setup requirements across the application. Improve credential utilities and quicksetup UI Remove quickSetup from the API and standarize responses
…ndling in AnswersProvider, and enhance sidekick details integration in AssistantInfoCard. Adjust SWR revalidation settings for improved performance and fix permission checks in findSidekickById utility. updated mcp init error message Simplify button text, remove innecesary console.log Remove innecesary console.log
…ick-setup-modal feat: implement QuickSetup modal for Sidekick credential management (AAI-490)
…nnection options (#435)
…n Vulnerability (#436)
Fix selected sidekick to include useSidekickDetail
- axios 1.7.9 → 1.8.2 (fixes SSRF vulnerability GHSA-8hc4-vh64-cxmj) - form-data 4.0.3 → 4.0.4 (fixes security issue) - linkifyjs 4.1.1 → 4.3.2 (fixes XSS vulnerability GHSA-v928-3xhj-f4h2) Updates applied across packages: apps/web, packages-answers/ui, packages-answers/utils, packages/components, packages/server, packages/ui
- Update embed submodule pointer to commit a5c8cf5 - Includes axios 1.8.2 (fixes SSRF vulnerability GHSA-8hc4-vh64-cxmj) - Includes form-data 4.0.4 (fixes security issue) - Converts embed from yarn to pnpm for consistency This ensures git submodule update --init pulls the secure versions.
- Remove axios 1.7.9 override that was forcing vulnerable versions - Update pnpm-lock.yaml with secure axios 1.8.2 across all packages - Embed submodule now properly uses secure dependencies - Fixes SSRF vulnerability GHSA-8hc4-vh64-cxmj All packages now use axios 1.8.2 without version conflicts.
- Upgrade rimraf from 3.0.2 to 6.0.1 for improved performance and features. - Reformat pnpm-lock.yaml for consistency and clarity in dependency structure. This ensures the project uses the latest version of rimraf while maintaining a clean lockfile.
…lify security fix
- Add pnpm overrides for ws@8.17.1, axios@1.8.2, qs@6.7.3, tar-fs@3.0.9 - Update AWS SDK packages to latest versions (3.859.0) - Update rollup to 3.29.5 to patch XSS vulnerability - Update pdfjs-dist to 4.2.67 to patch arbitrary JS execution - Update tsup to 7.2.0 for better rollup compatibility - Update oclif to v4 to fix lodash.template vulnerability - Update puppeteer to v21 to fix ws and tar-fs vulnerabilities - Update docusaurus to 3.8.1 to fix image-size vulnerability - Remove rollup-plugin-uglify from embed package - All high vulnerabilities now eliminated (0 high, 28 moderate, 11 low)
…ncements-patch-updates-etc fix: 🔒 Comprehensive Security Vulnerability Remediation & Dependency Standardization
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
…bility and security (#449)
maxtechera
temporarily deployed
to
staging - theanswer-web-x1q0
August 5, 2025 22:37 — with 
Render
Inactive
Render
Inactive
maxtechera
temporarily deployed
to
staging - theanswer-web-x1q0
August 5, 2025 22:42 — with
Render
Inactive
Render
Inactive
ct3685
marked this pull request as ready for review
August 5, 2025 22:42
|
ct3685
added
bug
ct3685
changed the title
maxtechera
temporarily deployed
to
staging - theanswer-iek0
August 5, 2025 23:14 — with
Render
Inactive
Render
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔐🚀 [ Release 2025-08-05 ] Full Security Remediation, Dependency Overhaul, Credential Infrastructure, and Sidekick Enhancements
Overview
This production release delivers a massive security, infrastructure, and functional upgrade across the entire codebase. It addresses all high and critical vulnerabilities, introduces a comprehensive credential management and validation system, enhances the Sidekick AI experience, and upgrades the build, deployment, and workspace toolchains for long-term maintainability and security posture.
This is the final promotion of the major staging PR: 🔒 Comprehensive Security Vulnerability Remediation & Dependency Standardization, along with additional major enhancements in DX, tooling, Copilot integration, and user-facing workflows.
🛡️ Security Remediation & Dependency Upgrades
All high and critical vulnerabilities have been eliminated through a series of direct updates and enforced security overrides. Notable changes:
🔧 Direct Dependency Updates
1.7.9 → 1.8.2— SSRF fix (GHSA-8hc4-vh64-cxmj)3.23.0 → 3.29.5— Patches for XSS and mapping issues3.8.162 → 4.2.67— Arbitrary JS execution patch^20.7.1 → ^21.0.0— DoS and path traversal fixes (viawsandtar-fs)lodash.templateinjection3.7.0 → 3.8.1— Fixes forimage-sizeDoS and transitive issues🔒 pnpm Security Overrides
6.7.0 → 6.7.3— Prototype pollution3.0.4 → 3.0.9— Path traversal8.16.0 → 8.17.1— DoS protection🧹 Package & Build System Cleanups
rollup-plugin-uglify→ Replaced with secure@rollup/plugin-terseryarntopnpmfor unified workspace management🔐 Credential Management System
A major new capability has been introduced to validate, detect, and manage required credentials for sidekicks and connected services:
🧰 Backend Credential Validation
extractAllCredentials,extractMissingCredentials: Analyze expected vs. actual secrets, including Redis and vector store supportfindSidekickByIdandfindSidekicksForChat🧪 Frontend Credential UX
useCredentialCheckerhook for reactive validationUnifiedCredentialsModal: Complete credentials editor with:🧠 Sidekick & Assistant Enhancements
CheckCircle,WarningAmber)useSidekickDetails🧱 Infra, Build, and DevX Improvements
☁️ AWS Copilot Integration
copilot/web/manifest.ymlwith:🐳 Docker Enhancements
/docker-entrypoint-initdb.d/init-db-and-migrate.shensures schema migration and seeding🔧 Build Consistency & DX
~5.5.2across all packages^8.57.0rimrafupgraded from v3 → v6ec5760f📊 Security Impact
✅ Validation & Testing
🔄 Affected Components
package.jsonfilesembedsubmodules and rollup configsutils/credentials/🚀 Release Notes Summary