opensource/hoppscotch
3
0
Fork 0
mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-10-25 10:06:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: patch high severity vulnerabilities in backend deps and caddy

Browse Source 
- pnpm overrides: fast-uri 3.1.6, js-yaml 4.3.2, liquidjs 10.27.2,
  multer 2.3.0, mysql2 3.23.1, nodemailer 9.1.0, qs 6.16.0, svgo 4.1.0
- backend: nodemailer 9.0.5 -> 9.1.0
- prod.Dockerfile (caddy): grpc v1.83.2, golang.org/x/crypto v0.56.0
This commit is contained in:
“mirarifhasan”
2026-09-28 14:31:47 +06:00
parent e633b55a0b
commit daf40aa70e
4 changed files with 216 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
package.json
+8 -6
View File
@@ -43,20 +43,22 @@
"cross-spawn": "7.0.6",
"deepmerge-ts@<8.0.0": "8.0.1",
"execa@<2.0.0": "2.0.0",
"fast-uri@>=3.0.0 <3.1.5": "3.1.5",
"fast-uri@>=3.0.0 <3.1.6": "3.1.6",
"find-my-way@9.6.0": "9.7.0",
"form-data@>=4.0.0 <4.0.6": "4.0.6",
"js-yaml@>=4.0.0 <4.3.1": "4.3.1",
"js-yaml@>=4.0.0 <4.3.2": "4.3.2",
"js-yaml@>=5.0.0 <=5.2.1": "5.2.2",
"linkify-it@<=5.0.1": "5.0.2",
"liquidjs@<10.27.0": "10.27.1",
"liquidjs@<10.27.2": "10.27.2",
"minimatch@>=4.0.0 <4.2.5": "4.2.5",
"mjml@<5.0.0-alpha.9": "5.4.0",
"nodemailer@<=9.0.0": "9.0.1",
"multer@<2.3.0": "2.3.0",
"mysql2@<3.22.0": "3.23.1",
"nodemailer@<9.1.0": "9.1.0",
"postcss@<=8.5.22": "8.5.26",
"qs@>=6.11.1 <6.15.2": "6.15.3",
"qs@>=6.11.1 <6.16.0": "6.16.0",
"serialize-javascript@<7.0.7": "7.0.7",
"svgo@>=4.0.0 <4.0.2": "4.0.2",
"svgo@>=4.0.0 <4.1.0": "4.1.0",
"uuid@9.0.1": "11.1.1",
"valibot@<=1.4.1": "1.4.2",
"vue": "3.5.41",
packages/hoppscotch-backend/package.json
+1 -1
View File
@@ -64,7 +64,7 @@
"handlebars": "4.7.9",
"io-ts": "2.2.22",
"morgan": "1.11.0",
"nodemailer": "9.0.5",
"nodemailer": "9.1.0",
"passport": "0.7.0",
"passport-github2": "0.1.12",
"passport-google-oauth20": "2.0.0",
pnpm-lock.yaml
Generated
+203 -184
View File
File diff suppressed because it is too large Load Diff
prod.Dockerfile
+4 -2
View File
@@ -39,8 +39,10 @@ RUN expected="e44e457ba3f2b5b8447952d2de0ae0a91b09d1a013e2521527e08b6f52acc9eb"
(echo "❌ Caddy Source Checksum failed!" && exit 1)
WORKDIR /tmp/caddy-build
RUN tar -xzf /tmp/caddy-build/src.tar.gz && \
# Fix GHSA-hrxh-6v49-42gf: upgrade grpc v1.82.1 (HIGH - DoS via crafted HTTP/2 request)
go get google.golang.org/grpc@v1.82.1 && \
# Fix CVE-2026-84304, CVE-2026-84445: upgrade grpc v1.83.2 (HIGH)
go get google.golang.org/grpc@v1.83.2 && \
# Fix CVE-2026-56854: upgrade golang.org/x/crypto v0.56.0 (HIGH - SSH auth bypass)
go get golang.org/x/crypto@v0.56.0 && \
# Fix CVE-2026-34986: upgrade go-jose v3 (HIGH - DoS via crafted JWE)
go get github.com/go-jose/go-jose/v3@v3.0.5 && \
# Fix CVE-2026-46600: upgrade golang.org/x/net v0.56.0 (HIGH - panic on invalid DNS RR)