[ Release 2025-08-06 ] Part 2 Security Remediation, Dependency Overhaul - #456
Merged
Conversation
- SSRF #29: FlowiseStream.ts - Added URL validation before fetch - SSRF #28: utils.ts xmlScrape - Added isSecureURL validation - SSRF #27: utils.ts crawl - Added isSecureURL validation - Type Confusion #6: getChatMessage.ts - Added Array.isArray check Security improvements: - Created centralized URL validation in validator.ts - Blocks localhost, private IPs, cloud metadata endpoints - Type-safe enum validation to prevent parameter tampering - Minimal, surgical fixes without breaking functionality Fixes GitHub code scanning alerts #29, #28, #27, #6
…ml-workflow feat: Add SonarCloud Static Analysis GitHub Workflow
…rabilities Fix/critical security vulnerabilities
…tes branch for temporary build check
…security - Update embed submodule to track ct/staging-pnpm-recursive-updates branch - Upgrade various dependencies in package.json files across multiple packages to their latest versions for better performance and security - Ensure consistency in package versions and resolve potential vulnerabilities
…roved compatibility and security - Upgrade cypress to version 13.17.0 for enhanced testing capabilities - Update lint-staged to version 15.2.0 for better performance - Modify dependency versions in pnpm-lock.yaml to use minimum required versions for better stability - Remove deprecated request package from packages-answers/utils/package.json to streamline dependencies
…roved compatibility and performance - Add postcss@8.4.31, tsup@8.3.5, and jsforce@3.10.0 to package.json for enhanced functionality - Remove react-scripts from packages/ui/package.json to streamline dependencies - Upgrade tsup in packages-answers/ui/package.json to version 8.3.5 for better build performance - Modify pnpm-lock.yaml to reflect updated dependency versions for consistency and stability
…roved functionality - Refactor BWS Secure scripts to utilize execBwsCommandWithRetrySync for better error handling and retry logic - Update README.md for clearer instructions on creating access tokens - Upgrade dotenv, dotenv-cli, yargs, and axios in package.json for compatibility and performance improvements - Add bws-retry-utils.js for managing rate limits and retry logic in BWS commands - Ensure consistent logging and error handling across BWS Secure scripts
…enhanced compatibility
- Change 'as' to 'AS' for consistency in stage definitions - Ensure clarity in multi-stage build process by standardizing syntax
- Change submodule branch from ct/staging-pnpm-recursive-updates to a-main - Update subproject commit reference for improved stability
- Upgrade actions/checkout from v3 to v4 for enhanced functionality - Set fetch-depth to 0 for complete history retrieval during checkout
- Delete the SonarCloud analysis workflow file, running CI analysis with Automatic Analysis.
- Change 'AS' to 'as' for consistency in stage definitions - Improve clarity in multi-stage build process by standardizing syntax
- Remove 'path-to-regexp: "0.1.12"' from pnpm.overrides in package.json - This was forcing @oclif/core@4.0.7 to use old path-to-regexp version without .match() method - Fixes 'pathRegexp.match is not a function' error that prevented CLI command registration - CLI now properly discovers start/worker commands when environment variables are provided - Revert multer-cloud-storage back to ^4.1.0 (was incorrectly blamed for the issue) - Deployment should now work as CLI commands are properly discoverable
…otentially security: upgrade dependencies to eliminate known vulnerabilities across monorepo
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
ct3685
added
dependencies
ct3685
marked this pull request as ready for review
August 6, 2025 14:06
maxtechera
temporarily deployed
to
staging - theanswer-iek0
August 6, 2025 14:08 — with 
Render
Inactive
Render
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[ Release 2025-08-06 ] Part 2 Security Remediation, Dependency Overhaul
This PR represents the second major phase of security remediation and dependency modernization across the codebase. Key changes include:
/api/ai/streamroute and the associatedFlowiseStreamutility, removing real-time AI chat streaming tied to Flowise socket connections.isSecureURLchecks).sanitizeURL,validateEnumArray, etc.).dependenciesanddevDependenciesin all packages (web, utils, db, server, components, etc.), addressing outdated and vulnerable versions.@emotion/*,ioredis,jose,stripe,typeorm,handlebars,cypress,eslint,typescript, and many more.prismjs,express,serve-static,cookie,postcss,webpack-dev-server, etc.).chat-messagescontroller using new reusablevalidateEnumArray()logic for consistency and safety.pyodideand standardized the TypeScript target to includeES2022.bws-retry-utils.js) to better manage rate limits.This update is part of an ongoing effort to reduce technical debt, eliminate insecure legacy code paths, and modernize the platform’s runtime environment. Additional refactors and cleanups will follow in future patches.