Skip to content

Commit 8471169

Browse files
ericallamericallam
authored
Fix various dependabot alerts (#2063)
* Upgrade posthog-node to clear axios vulns * Upgrade @slack/web-api to use a secure version of axios * Update parse-duration to fix security vulns * Mitigate against the ws DoS vuln * Upgrade body-parser to 1.20.3 in the webapp * Upgrade react-use to 17.5.1 to remove the fast-loops transitive dep * Remove unused babel dev deps and config file that's no longer used * Upgrade prismjs to 1.30.0 and bundle parse-duration now * upgrade express to 4.20.0 to fix issue with XSS when redirecting * Upgrade @conform/zod to 0.9.2
1 parent 558a39c commit 8471169

File tree

17 files changed

+327
-1821
lines changed

17 files changed

+327
-1821
lines changed

‎apps/webapp/.babelrc.json

Lines changed: 0 additions & 16 deletions
This file was deleted.

‎apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts.new/route.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
186186
const project = await findProjectBySlug(organizationSlug, projectParam, userId);
187187

188188
if (!project) {
189-
submission.error.key = "Project not found";
189+
submission.error.key = ["Project not found"];
190190
return json(submission);
191191
}
192192

@@ -198,7 +198,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
198198
);
199199

200200
if (!alertChannel) {
201-
submission.error.key = "Failed to create alert channel";
201+
submission.error.key = ["Failed to create alert channel"];
202202
return json(submission);
203203
}
204204

‎apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.alerts/route.tsx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
122122
const project = await findProjectBySlug(organizationSlug, projectParam, userId);
123123

124124
if (!project) {
125-
submission.error.key = "Project not found";
125+
submission.error.key = ["Project not found"];
126126
return json(submission);
127127
}
128128

‎apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
145145
},
146146
});
147147
if (!project) {
148-
submission.error.key = "Project not found";
148+
submission.error.key = ["Project not found"];
149149
return json(submission);
150150
}
151151

@@ -158,11 +158,11 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
158158
const index = submission.value.variables.findIndex((v) => v.key === key);
159159

160160
if (index !== -1) {
161-
submission.error[`variables[${index}].key`] = error;
161+
submission.error[`variables[${index}].key`] = [error];
162162
}
163163
}
164164
} else {
165-
submission.error.variables = result.error;
165+
submission.error.variables = [result.error];
166166
}
167167

168168
return json(submission);

‎apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
142142
},
143143
});
144144
if (!project) {
145-
submission.error.key = "Project not found";
145+
submission.error.key = ["Project not found"];
146146
return json(submission);
147147
}
148148

@@ -152,7 +152,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
152152
const result = await repository.editValue(project.id, submission.value);
153153

154154
if (!result.success) {
155-
submission.error.key = result.error;
155+
submission.error.key = [result.error];
156156
return json(submission);
157157
}
158158

@@ -175,7 +175,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
175175
const result = await repository.deleteValue(project.id, submission.value);
176176

177177
if (!result.success) {
178-
submission.error.key = result.error;
178+
submission.error.key = [result.error];
179179
return json(submission);
180180
}
181181

‎apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.promote.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,11 @@ export const action: ActionFunction = async ({ request, params }) => {
7979
stack: error.stack,
8080
},
8181
});
82-
submission.error = { runParam: error.message };
82+
submission.error = { runParam: [error.message] };
8383
return json(submission);
8484
} else {
8585
logger.error("Failed to promote deployment", { error });
86-
submission.error = { runParam: JSON.stringify(error) };
86+
submission.error = { runParam: [JSON.stringify(error)] };
8787
return json(submission);
8888
}
8989
}

‎apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.retry-indexing.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,15 +93,15 @@ export const action: ActionFunction = async ({ request, params }) => {
9393
projectId,
9494
deploymentShortCode,
9595
});
96-
submission.error = { runParam: error.message };
96+
submission.error = { runParam: [error.message] };
9797
return json(submission);
9898
} else {
9999
logger.error("Failed to retry deployment indexing", {
100100
error,
101101
projectId,
102102
deploymentShortCode,
103103
});
104-
submission.error = { runParam: JSON.stringify(error) };
104+
submission.error = { runParam: [JSON.stringify(error)] };
105105
return json(submission);
106106
}
107107
}

‎apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.rollback.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,11 +82,11 @@ export const action: ActionFunction = async ({ request, params }) => {
8282
stack: error.stack,
8383
},
8484
});
85-
submission.error = { runParam: error.message };
85+
submission.error = { runParam: [error.message] };
8686
return json(submission);
8787
} else {
8888
logger.error("Failed to roll back deployment", { error });
89-
submission.error = { runParam: JSON.stringify(error) };
89+
submission.error = { runParam: [JSON.stringify(error)] };
9090
return json(submission);
9191
}
9292
}

‎apps/webapp/app/routes/resources.feedback.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ export async function action({ request }: ActionFunctionArgs) {
8383
"Thanks for your feedback! We'll get back to you soon."
8484
);
8585
} catch (e) {
86-
submission.error.message = e instanceof Error ? e.message : "Unknown error";
86+
submission.error.message = [e instanceof Error ? e.message : "Unknown error"];
8787
return json(submission);
8888
}
8989
}

‎apps/webapp/app/routes/resources.taskruns.$runParam.cancel.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ export const action: ActionFunction = async ({ request, params }) => {
3232
});
3333

3434
if (!taskRun) {
35-
submission.error = { runParam: "Run not found" };
35+
submission.error = { runParam: ["Run not found"] };
3636
return json(submission);
3737
}
3838

‎apps/webapp/package.json

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,8 @@
4343
"@codemirror/search": "^6.2.3",
4444
"@codemirror/state": "^6.1.3",
4545
"@codemirror/view": "^6.5.0",
46-
"@conform-to/react": "^0.6.1",
47-
"@conform-to/zod": "^0.6.1",
46+
"@conform-to/react": "0.9.2",
47+
"@conform-to/zod": "0.9.2",
4848
"@depot/sdk-node": "^1.0.0",
4949
"@depot/cli": "0.0.1-cli.2.80.0",
5050
"@electric-sql/react": "^0.3.5",
@@ -92,7 +92,7 @@
9292
"@remix-run/serve": "2.1.0",
9393
"@remix-run/server-runtime": "2.1.0",
9494
"@remix-run/v1-meta": "^0.1.3",
95-
"@slack/web-api": "^6.8.1",
95+
"@slack/web-api": "7.9.1",
9696
"@socket.io/redis-adapter": "^8.3.0",
9797
"@splinetool/react-spline": "^2.2.6",
9898
"@tabler/icons-react": "^2.39.0",
@@ -126,7 +126,7 @@
126126
"effect": "^3.11.7",
127127
"emails": "workspace:*",
128128
"evt": "^2.4.13",
129-
"express": "^4.18.1",
129+
"express": "4.20.0",
130130
"framer-motion": "^10.12.11",
131131
"graphile-worker": "0.16.6",
132132
"highlight.run": "^7.3.4",
@@ -146,12 +146,12 @@
146146
"non.geist": "^1.0.2",
147147
"ohash": "^1.1.3",
148148
"openai": "^4.33.1",
149-
"parse-duration": "^1.1.0",
149+
"parse-duration": "^2.1.0",
150150
"p-limit": "^6.2.0",
151151
"posthog-js": "^1.93.3",
152-
"posthog-node": "^3.1.3",
152+
"posthog-node": "4.17.1",
153153
"prism-react-renderer": "^2.3.1",
154-
"prismjs": "^1.29.0",
154+
"prismjs": "^1.30.0",
155155
"prom-client": "^15.1.0",
156156
"random-words": "^2.0.0",
157157
"react": "^18.2.0",
@@ -162,7 +162,7 @@
162162
"react-popper": "^2.3.0",
163163
"react-resizable-panels": "^2.0.9",
164164
"react-stately": "^3.29.1",
165-
"react-use": "^17.4.0",
165+
"react-use": "17.5.1",
166166
"react-window-splitter": "^0.4.1",
167167
"recharts": "^2.12.6",
168168
"regression": "^2.0.1",
@@ -232,8 +232,6 @@
232232
"@typescript-eslint/eslint-plugin": "^5.59.6",
233233
"@typescript-eslint/parser": "^5.59.6",
234234
"autoprefixer": "^10.4.13",
235-
"babel-loader": "^9.1.3",
236-
"babel-preset-react-app": "^10.0.1",
237235
"css-loader": "^6.10.0",
238236
"datepicker": "link:@types/@react-aria/datepicker",
239237
"engine.io": "^6.5.4",

‎apps/webapp/remix.config.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ module.exports = {
2424
"prismjs/components/prism-json",
2525
"prismjs/components/prism-typescript",
2626
"redlock",
27+
"parse-duration",
2728
],
2829
browserNodeBuiltinsPolyfill: { modules: { path: true, os: true, crypto: true } },
2930
};

‎apps/webapp/server.ts

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,10 @@ if (process.env.HTTP_SERVER_DISABLED !== "true") {
129129
});
130130

131131
server.keepAliveTimeout = 65 * 1000;
132+
// Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
133+
// by not allowing 2000+ headers to be sent and causing a DoS
134+
// headers will instead be limited by the maxHeaderSize
135+
server.maxHeadersCount = 0;
132136

133137
process.on("SIGTERM", () => {
134138
server.close((err) => {

‎package.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,9 @@
7979
"graphile-worker@0.16.6": "patches/graphile-worker@0.16.6.patch",
8080
"redlock@5.0.0-beta.2": "patches/redlock@5.0.0-beta.2.patch",
8181
"@kubernetes/client-node@1.0.0": "patches/@kubernetes__client-node@1.0.0.patch"
82+
},
83+
"overrides": {
84+
"express@^4>body-parser": "1.20.3"
8285
}
8386
}
8487
}

0 commit comments

Comments
 (0)