chore(release): staging to production - 2025.11.24 - #729
Merged
Conversation
…og-node) (#728) ## Title hotfix: remove Shai-Hulud-2 vulnerable dependencies (kill-port, posthog-node) ## Description ### Motivation & Scope This change is a focused hotfix to address the Shai-Hulud-2 security vulnerability by removing the affected dependencies and disabling the associated telemetry functionality. Scope is limited to: - Removing vulnerable dependencies (`kill-port`, `posthog-node`) and their transitive deps from the dependency tree. - Converting the telemetry implementation to a no-op while preserving its public API. ### Changes - **Root `package.json`** - Removed dev dependency: - `"kill-port": "^2.0.1"`. - **`packages/server/package.json`** - Removed dependency: - `"posthog-node": "^3.6.3"`. - **`packages/server/src/utils/telemetry.ts`** - Removed `PostHog` import from `posthog-node`. - Removed `Telemetry.postHog` client field and initialization logic that depended on `POSTHOG_PUBLIC_API_KEY`. - Updated `Telemetry` constructor to document that PostHog has been removed due to the Shai-Hulud-2 security vulnerability and telemetry is now disabled. - Updated `sendTelemetry` and `flush` to be explicit no-op implementations with comments explaining that telemetry is disabled but the API is preserved. - **`pnpm-lock.yaml`** - Lockfile updated to: - Remove `kill-port`, `posthog-node`, and their transitive dependencies (`get-them-args`, `shell-exec`, `rusha`, etc.). - Normalize a few dependency graph annotations (e.g., `@auth0/nextjs-auth0`, `next-auth`, webpack-related plugins, eslint-related packages) as a result of the lockfile regeneration without the removed packages. ### Impact - **Functional Behavior** - Telemetry collection via PostHog is completely disabled. - Calls to `Telemetry.id()`, `Telemetry.sendTelemetry()`, and `Telemetry.flush()` still exist and remain callable, but `sendTelemetry` and `flush` are now no-ops. - No user-facing API or behavior should change outside of the absence of analytics/telemetry events. - **Security** - Removes dependencies explicitly tied to the Shai-Hulud-2 vulnerability: - `kill-port` - `posthog-node` - Also drops their transitive dependencies from the install surface, reducing potential security exposure. - **Dependencies / Build** - Dependency graph is simplified with the removal of `kill-port` and `posthog-node`. - No new dependencies are introduced. - Lockfile updates are consistent with the package.json removals and underlying resolver behavior. ### Breaking Changes / Migrations - No breaking API or schema changes are apparent from the diff. - Telemetry data will stop being recorded and sent, which may be a behavioral change for any downstream analytics or monitoring relying on PostHog events. - Environment variable `POSTHOG_PUBLIC_API_KEY` is no longer used by the server code. ### Testing Notes - No tests were added or modified in this diff. - Recommended follow-up: - Ensure existing code paths that call `Telemetry` methods continue to function without relying on side effects. - Optionally, add unit tests asserting that `Telemetry.sendTelemetry` and `Telemetry.flush` are safe no-ops (do not throw, do not require any configuration).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
maxtechera
temporarily deployed
to
staging - aai-unified2-flowise-moonstruck
November 24, 2025 21:24 — with 
Render
Inactive
Render
Inactive
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚀 Release: Staging to Production
Release Date: 2025-11-24
Changes in this release
This PR is automatically created/updated when commits are pushed to staging.
Merging this PR will trigger the release workflow to create a new GitHub release.