Skip to content

security bumps #8752

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daneryl merged 8 commits into from
Feb 4, 2026
+317 −93
Merged

security bumps #8752

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d65f047
several bumps
Zasa-san Jan 26, 2026
2c42f92
body-parser bump
Zasa-san Jan 26, 2026
cfc8a22
fix type error
Zasa-san Jan 26, 2026
63822a7
restore body-parser resolution
Zasa-san Jan 26, 2026
340eac8
Merge branch 'production' into security-bumps
Zasa-san Jan 27, 2026
f5a70bc
Merge branch 'production' into security-bumps
daneryl Feb 4, 2026
478789f
Fix hasOwnProperty errors after dependency upgrades
daneryl Feb 4, 2026
d648b7c
Fix high-severity vulnerabilities in fast-xml-parser
daneryl Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions app/api/search.v2/buildQuery.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,10 +6,10 @@ import { extractSearchParams, snippetsHighlight } from './queryHelpers';
type Filter = (RangeFilter | CompoundFilter | string | number | boolean) | undefined;

const isRange = (range: Filter): range is RangeFilter =>
typeof range === 'object' && (range.hasOwnProperty('from') || range.hasOwnProperty('to'));
typeof range === 'object' && (Object.hasOwn(range, 'from') || Object.hasOwn(range, 'to'));

const isCompound = (filterValue: Filter): filterValue is CompoundFilter =>
typeof filterValue === 'object' && filterValue.hasOwnProperty('values');
typeof filterValue === 'object' && Object.hasOwn(filterValue, 'values');

const getFilterValue = (filterValue: Filter) => {
if (isCompound(filterValue)) {
Expand Down
2 changes: 1 addition & 1 deletion app/api/search.v2/permissionsFilters.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import { cleanUp } from './queryHelpers';

export const permissionsFilters = (query: SearchQuery) => {
const user = permissionsContext.getUserInContext();
const publishedFilter = query.filter?.hasOwnProperty('published');
const publishedFilter = query.filter && Object.hasOwn(query.filter, 'published');

return [
!user && { term: { published: query.filter?.published === false ? 'not_allowed' : 'true' } },
Expand Down
2 changes: 1 addition & 1 deletion app/api/search.v2/queryHelpers.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,7 @@ function snippetsHighlight(query: SearchQuery, fields: { [key: string]: {} }[] |
post_tags: ['</b>'],
encoder: 'html',
number_of_fragments: 9999,
...(fields?.[0].hasOwnProperty('fullText_*') ? { type: 'fvh' } : {}),
...(fields?.[0] && Object.hasOwn(fields[0], 'fullText_*') ? { type: 'fvh' } : {}),
fragment_size: 300,
fragmenter: 'span',
fields,
Expand Down
2 changes: 1 addition & 1 deletion app/api/utils/specs/supertestExtensions.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ describe('assertStatus', () => {
text: JSON.stringify('validation error'),
});
await expect(result.message).toMatch('validation error');
expect(result.stack).toBeUndefined();
expect(result.stack).toBeDefined();
});
});
});
1 change: 0 additions & 1 deletion app/api/utils/supertestExtensions.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,6 @@ export function extendSupertest() {
const err: Error = _assertStatus(status, res);
if (err) {
err.message += `\n ${extractStatusDebugInfo(res)}`;
delete err.stack;
}
return err;
};
Expand Down
1 change: 1 addition & 0 deletions app/react/V2/Routes/Entity/specs/loader.spec.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ describe('Entity loader with cache integration', () => {
params: { sharedId },
request: { url } as Request,
context: '',
unstable_pattern: '',
});
};

Expand Down
30 changes: 16 additions & 14 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,9 +81,10 @@
"trim": "1.0.1",
"node-fetch": "2.6.7",
"ws": "8.18.0",
"body-parser": "^1.20.3",
"body-parser": "^1.20.4",
"cross-spawn": "^7.0.5",
"form-data": "^4.0.4"
"form-data": "^4.0.4",
"fast-xml-parser": "^5.3.4"
},
"dependencies": {
"@aws-sdk/client-s3": "3.744.0",
Expand Down Expand Up @@ -115,7 +116,6 @@
"@tailwindcss/postcss": "^4.1.16",
"@tanstack/react-table": "8.21.2",
"@types/franc": "^5.0.1",
"@types/lodash": "^4.14.170",
"@types/mime-types": "^2.1.1",
"@types/react-dropzone": "^4.2.2",
"@types/redis": "^2.8.31",
Expand All @@ -127,7 +127,7 @@
"any-date-parser": "^1.5.4",
"bcryptjs": "^3.0.2",
"big.js": "^7.0.1",
"body-parser": "^1.20.3",
"body-parser": "1.20.4",
"bootstrap": "3.4.1",
"child-process-promise": "^2.2.1",
"clean-insights-sdk": "^2.6.2",
Expand All @@ -142,9 +142,9 @@
"diacritics": "^1.3.0",
"domhandler": "^5.0.3",
"dotenv": "^16.4.7",
"express": "4.21.2",
"express": "4.22.0",
"express-http-proxy": "^2.1.1",
"express-prom-bundle": "^7.0.0",
"express-prom-bundle": "^8.0.0",
Copy link

Copilot AI Jan 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The express-prom-bundle package has been upgraded from v7 to v8, which now requires @types/express ^5.0.0 as a dependency (see yarn.lock line 9076). However, the project's devDependencies specify @types/express ^4.17.25 (line 283). This creates a type definition conflict where two incompatible versions of Express types coexist in the dependency tree.

While this may not cause runtime issues since express-prom-bundle is only used in app/server.js (a non-TypeScript file), it could cause:

  1. TypeScript compilation issues if server.js is converted to TypeScript in the future
  2. IDE type inference problems
  3. Confusion about which Express types are the canonical ones

Consider either:

  • Upgrading @types/express in devDependencies to ^5.0.0 to match express-prom-bundle's requirement, or
  • Verifying that @types/express v4 and v5 are compatible for your use case
Suggested change
"express-prom-bundle": "^8.0.0",
"express-prom-bundle": "^7.0.0",

Copilot uses AI. Check for mistakes.
"express-session": "^1.18.1",
"filesize": "10.1.6",
"flag-icons": "^7.5.0",
Expand All @@ -165,7 +165,7 @@
"leaflet": "^1.9.4",
"leaflet.gridlayer.googlemutant": "^0.15.0",
"leaflet.markercluster": "^1.5.3",
"lodash": "^4.17.21",
"lodash": "^4.17.23",
"luxon": "^3.7.2",
"mark.js": "^8.11.1",
"markdown-it": "^14.1.0",
Expand All @@ -190,7 +190,7 @@
"prom-client": "^15.1.3",
"prop-types": "^15.8.1",
"qrcode.react": "^4.2.0",
"qs": "^6.14.0",
"qs": "^6.14.1",
"react": "^18.3.1",
"react-color": "^2.19.3",
"react-datepicker": "7.5.0",
Expand All @@ -210,7 +210,7 @@
"react-redux": "5.0.6",
"react-redux-form": "^1.16.14",
"react-render-if-visible": "^2.1.1",
"react-router": "^7.5.2",
"react-router": "^7.13.0",
"react-table": "^7.8.0",
"react-tabs-redux": "4.0.0",
"react-widgets": "v4.6.1",
Expand All @@ -229,7 +229,7 @@
"socket.io": "4.8.1",
"socket.io-client": "4.8.1",
"stopword": "3.1.4",
"superagent": "10.1.1",
"superagent": "^10.3.0",
"svg-captcha": "^1.4.0",
"tiny-cookie": "^2.5.1",
"typescript": "5.7.3",
Expand Down Expand Up @@ -277,12 +277,12 @@
"@testing-library/jest-dom": "6.6.3",
"@testing-library/react": "^16.2.0",
"@testing-library/user-event": "^14.6.1",
"@types/body-parser": "^1.19.5",
"@types/body-parser": "^1.19.6",
"@types/child-process-promise": "^2.2.1",
"@types/enzyme": "3.10.12",
"@types/enzyme-adapter-react-16": "1.0.2",
"@types/expect-puppeteer": "4.4.7",
"@types/express": "^4.17.21",
"@types/express": "^4.17.25",
"@types/express-session": "^1.18.0",
"@types/google.maps": "^3.48.2",
"@types/immutable": "^3.8.7",
Expand All @@ -293,28 +293,30 @@
"@types/leaflet.gridlayer.googlemutant": "^0.4.6",
"@types/leaflet.markercluster": "^1.4.6",
"@types/loadable__component": "^5.13.9",
"@types/lodash": "^4.17.23",
"@types/luxon": "^3.7.1",
"@types/markdown-it": "^14.1.2",
"@types/multer": "^1.4.7",
"@types/node": "^16.18.3",
"@types/node-uuid": "^0.0.28",
"@types/nodemailer": "^6.4.17",
"@types/prop-types": "^15.7.3",
"@types/qs": "^6.9.18",
"@types/qs": "^6.14.0",
"@types/react": "^18.3.1",
"@types/react-dnd": "^3.0.2",
"@types/react-dom": "^18.0.9",
"@types/react-helmet": "^6.1.5",
"@types/react-modal": "^3.13.1",
"@types/react-redux": "^7.1.24",
"@types/react-router": "^5.1.20",
"@types/react-table": "^7.7.14",
"@types/react-tabs-redux": "^4.0.0",
"@types/recharts": "^1.8.24",
"@types/redux-mock-store": "^1.0.6",
"@types/sanitize-html": "^2.16.0",
"@types/socket.io": "^3.0.2",
"@types/socket.io-client": "^1.4.33",
"@types/superagent": "^8.1.6",
"@types/superagent": "^8.1.9",
"@types/supertest": "6.0.2",
"@types/webpack-env": "^1.18.1",
"@types/yargs-parser": "^20.2.1",
Expand Down
Loading
Loading