[PR #5487] [MERGED] chore: security patch for the dependency chain v2025.10.0 #5231

New issue

Closed

opened 2026-03-17 02:42:01 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:42:01 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5487
Author: @mirarifhasan
Created: 10/16/2025
Status: ✅ Merged
Merged: 10/22/2025
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-fix-2025-10-0

📝 Commits (4)

0750c9b chore: update dependencies and add express5 integration
91c8308 chore: update base images and dependencies for security
74b7b95 chore: improve NPM installation security in Dockerfile
c2e9f3e chore: bump non-major dependencies

📊 Changes

17 files changed (+2750 additions, -2464 deletions)

View changed files

📝 package.json (+6 -5)
📝 packages/codemirror-lang-graphql/package.json (+3 -3)
📝 packages/hoppscotch-agent/package.json (+2 -2)
📝 packages/hoppscotch-backend/package.json (+20 -19)
📝 packages/hoppscotch-cli/package.json (+2 -2)
📝 packages/hoppscotch-common/package.json (+14 -14)
📝 packages/hoppscotch-data/package.json (+1 -1)
📝 packages/hoppscotch-desktop/package.json (+4 -4)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json (+2 -2)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json (+2 -2)
📝 packages/hoppscotch-js-sandbox/package.json (+2 -2)
📝 packages/hoppscotch-kernel/package.json (+9 -9)
📝 packages/hoppscotch-selfhost-desktop/package.json (+7 -7)
📝 packages/hoppscotch-selfhost-web/package.json (+7 -7)
📝 packages/hoppscotch-sh-admin/package.json (+3 -3)
📝 pnpm-lock.yaml (+2640 -2373)
📝 prod.Dockerfile (+26 -9)

📄 Description

Closes BE-665

What's changed

This pull request primarily updates dependencies and base images to address security vulnerabilities and keep the project up to date. The most important changes are grouped below:

Security and Dependency Updates:

Upgraded base Alpine image in prod.Dockerfile from 3.22.1 to 3.22.2 for both Caddy builder and Node.js base, ensuring the latest security patches. [1] [2]
Updated Go version used in the Caddy build step from 1.25.1 to 1.25.3 to address CVE-2025-47907.
Added a direct patch for quic-go to version v0.55.0 in the Caddy build process to resolve a known CVE.
Changed npm installation in the Node.js base image to use a direct download from the npm registry (npm@11.6.2), avoiding vulnerabilities in Alpine's packaged version, and updated pnpm to 10.18.3.
Updated various dependencies in package.json and packages/hoppscotch-backend/package.json, including major upgrades to @commitlint, @nestjs, nodemailer, prisma, posthog-node, and development tools, improving security and compatibility. [1] [2] [3]

These changes collectively improve the security posture and reliability of the build and runtime environments.

Notes to reviewers

Build the app, and test the functionality.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5487 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 10/16/2025 **Status:** ✅ Merged **Merged:** 10/22/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-fix-2025-10-0` --- ### 📝 Commits (4) - [`0750c9b`](https://github.com/hoppscotch/hoppscotch/commit/0750c9b188a97d0f409e781a07813887dfb3fdd0) chore: update dependencies and add express5 integration - [`91c8308`](https://github.com/hoppscotch/hoppscotch/commit/91c83089a617405a3031e3e048d7c3b7878215d8) chore: update base images and dependencies for security - [`74b7b95`](https://github.com/hoppscotch/hoppscotch/commit/74b7b9573374d24fe460714d82c6ce5ae4397ce1) chore: improve NPM installation security in Dockerfile - [`c2e9f3e`](https://github.com/hoppscotch/hoppscotch/commit/c2e9f3eaf359a4f0fb7019753547204420f98b64) chore: bump non-major dependencies ### 📊 Changes **17 files changed** (+2750 additions, -2464 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+6 -5) 📝 `packages/codemirror-lang-graphql/package.json` (+3 -3) 📝 `packages/hoppscotch-agent/package.json` (+2 -2) 📝 `packages/hoppscotch-backend/package.json` (+20 -19) 📝 `packages/hoppscotch-cli/package.json` (+2 -2) 📝 `packages/hoppscotch-common/package.json` (+14 -14) 📝 `packages/hoppscotch-data/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/package.json` (+4 -4) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json` (+2 -2) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json` (+2 -2) 📝 `packages/hoppscotch-js-sandbox/package.json` (+2 -2) 📝 `packages/hoppscotch-kernel/package.json` (+9 -9) 📝 `packages/hoppscotch-selfhost-desktop/package.json` (+7 -7) 📝 `packages/hoppscotch-selfhost-web/package.json` (+7 -7) 📝 `packages/hoppscotch-sh-admin/package.json` (+3 -3) 📝 `pnpm-lock.yaml` (+2640 -2373) 📝 `prod.Dockerfile` (+26 -9) </details> ### 📄 Description    Closes BE-665  ### What's changed  This pull request primarily updates dependencies and base images to address security vulnerabilities and keep the project up to date. The most important changes are grouped below: **Security and Dependency Updates:** * Upgraded base Alpine image in `prod.Dockerfile` from `3.22.1` to `3.22.2` for both Caddy builder and Node.js base, ensuring the latest security patches. [[1]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L3-R3) [[2]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L42-R51) * Updated Go version used in the Caddy build step from `1.25.1` to `1.25.3` to address CVE-2025-47907. * Added a direct patch for `quic-go` to version `v0.55.0` in the Caddy build process to resolve a known CVE. * Changed npm installation in the Node.js base image to use a direct download from the npm registry (`npm@11.6.2`), avoiding vulnerabilities in Alpine's packaged version, and updated `pnpm` to `10.18.3`. * Updated various dependencies in `package.json` and `packages/hoppscotch-backend/package.json`, including major upgrades to `@commitlint`, `@nestjs`, `nodemailer`, `prisma`, `posthog-node`, and development tools, improving security and compatibility. [[1]](diffhunk://#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519L27-R42) [[2]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529R34-R48) [[3]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529L64-R112) These changes collectively improve the security posture and reliability of the build and runtime environments.  ### Notes to reviewers  Build the app, and test the functionality. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>