[PR #5678] [MERGED] chore: security patch for the dependency chain v2025.12.0 #5314

New issue

Closed

opened 2026-03-17 02:46:21 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:46:21 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5678
Author: @mirarifhasan
Created: 12/9/2025
Status: ✅ Merged
Merged: 12/12/2025
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-fix-2025-12-0

📝 Commits (2)

8c5f46a chore: update backend dependencies and resolve vuln
e022eec chore: bump non-major dependencies across packages

📊 Changes

21 files changed (+2017 additions, -1578 deletions)

View changed files

📝 package.json (+5 -5)
📝 packages/hoppscotch-agent/package.json (+5 -5)
📝 packages/hoppscotch-backend/package.json (+19 -19)
📝 packages/hoppscotch-cli/package.json (+4 -4)
📝 packages/hoppscotch-common/package.json (+21 -21)
📝 packages/hoppscotch-common/src/components/http/Request.vue (+1 -3)
📝 packages/hoppscotch-common/src/components/lenses/ResponseBodyRenderer.vue (+4 -4)
📝 packages/hoppscotch-common/src/helpers/import-export/import/postman.ts (+2 -2)
📝 packages/hoppscotch-common/src/helpers/runner/adapter.ts (+1 -3)
📝 packages/hoppscotch-common/src/services/documentation.service.ts (+2 -4)
📝 packages/hoppscotch-common/src/services/spotlight/searchers/base/static.searcher.ts (+2 -2)
📝 packages/hoppscotch-data/package.json (+2 -2)
📝 packages/hoppscotch-desktop/package.json (+11 -11)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json (+2 -2)
📝 packages/hoppscotch-js-sandbox/package.json (+5 -5)
📝 packages/hoppscotch-js-sandbox/src/types/index.ts (+1 -3)
📝 packages/hoppscotch-kernel/package.json (+4 -4)
📝 packages/hoppscotch-selfhost-web/package.json (+12 -12)
📝 packages/hoppscotch-sh-admin/package.json (+12 -12)
📝 pnpm-lock.yaml (+1888 -1439)

...and 1 more files

📄 Description

Closes BE-688

What's changed

This pull request primarily updates dependency versions across the project, focusing on improving security and stability. The changes include upgrades to several core libraries, Docker base images, and build tools to address recent CVEs and ensure compatibility with the latest releases.

Dependency upgrades for backend and build process:

Upgraded multiple dependencies in packages/hoppscotch-backend/package.json, including @nestjs/*, @prisma/*, nodemailer, cookie, express, class-validator, and several devDependencies, to their latest patch or minor versions for improved security and compatibility. [1] [2]
Updated overrides in the root package.json for packages such as body-parser, jws, nodemailer, and removed overrides for older versions, ensuring the use of patched versions and resolving vulnerabilities.

Dependency upgrades across other packages:

Updated non-major dependencies across hoppscotch-agent, hoppscotch-cli, hoppscotch-common, hoppscotch-data, hoppscotch-desktop, and hoppscotch-js-sandbox packages.
Bumped frontend tooling including Vue.js ecosystem packages (@vueuse/core, vue-router, @codemirror/view), build tools (vite, sass, autoprefixer), and development tools (@typescript-eslint, prettier, eslint, vitest).
Updated GraphQL code generation dependencies (@graphql-codegen packages) and security-focused packages (jose, dompurify, xmlbuilder2).

Dockerfile and build environment enhancements:

Updated the base Alpine Linux image in prod.Dockerfile from 3.22.2 to 3.23.0 for both Caddy and Node.js build stages, improving security and package availability. [1] [2]
Upgraded Go version to 1.25.5 and patched dependencies (smallstep/certificates, x/crypto) in the Caddy build stage to address recent CVEs. [1] [2]
Updated NPM to 11.6.4 and PNPM to 10.25.0 in the Node.js build stage, and improved the process for patching the vulnerable glob package.

These updates collectively enhance the project's security posture and ensure compatibility with the latest upstream releases.

Notes to reviewers

Nil

Summary by cubic

Security patch release that updates backend dependencies and the Docker build chain to resolve recent CVEs and improve stability. Addresses Linear BE-688.

Dependencies
- Bumped backend packages (NestJS, Prisma, Express 5.2.1, cookie 1.1.1, class-validator 0.14.3, nodemailer 7.0.11, posthog-node 5.17.2) and dev tools (ESLint, Nest CLI, Prettier, ts-jest).
- Updated root overrides to enforce patched versions (body-parser 2.2.1, jws 3.2.3, nodemailer 7.0.11) and removed outdated overrides.
- Refreshed pnpm-lock.yaml.
Docker/build
- Upgraded Alpine to 3.23.0 for Caddy and Node stages.
- Moved to Go 1.25.5 and patched deps (x/crypto v0.45.0, smallstep/certificates v0.29.0); rebuilt Caddy.
- Updated npm to 11.6.4 and pnpm to 10.25.0; globally patched glob to 11.1.0.

^{Written for commit e022eecf06. Summary will update automatically on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5678 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 12/9/2025 **Status:** ✅ Merged **Merged:** 12/12/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-fix-2025-12-0` --- ### 📝 Commits (2) - [`8c5f46a`](https://github.com/hoppscotch/hoppscotch/commit/8c5f46add37f980c82d2fa5f683e17aee44ca493) chore: update backend dependencies and resolve vuln - [`e022eec`](https://github.com/hoppscotch/hoppscotch/commit/e022eecf06f30689f2adc85700196e23edf24ad4) chore: bump non-major dependencies across packages ### 📊 Changes **21 files changed** (+2017 additions, -1578 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+5 -5) 📝 `packages/hoppscotch-agent/package.json` (+5 -5) 📝 `packages/hoppscotch-backend/package.json` (+19 -19) 📝 `packages/hoppscotch-cli/package.json` (+4 -4) 📝 `packages/hoppscotch-common/package.json` (+21 -21) 📝 `packages/hoppscotch-common/src/components/http/Request.vue` (+1 -3) 📝 `packages/hoppscotch-common/src/components/lenses/ResponseBodyRenderer.vue` (+4 -4) 📝 `packages/hoppscotch-common/src/helpers/import-export/import/postman.ts` (+2 -2) 📝 `packages/hoppscotch-common/src/helpers/runner/adapter.ts` (+1 -3) 📝 `packages/hoppscotch-common/src/services/documentation.service.ts` (+2 -4) 📝 `packages/hoppscotch-common/src/services/spotlight/searchers/base/static.searcher.ts` (+2 -2) 📝 `packages/hoppscotch-data/package.json` (+2 -2) 📝 `packages/hoppscotch-desktop/package.json` (+11 -11) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json` (+2 -2) 📝 `packages/hoppscotch-js-sandbox/package.json` (+5 -5) 📝 `packages/hoppscotch-js-sandbox/src/types/index.ts` (+1 -3) 📝 `packages/hoppscotch-kernel/package.json` (+4 -4) 📝 `packages/hoppscotch-selfhost-web/package.json` (+12 -12) 📝 `packages/hoppscotch-sh-admin/package.json` (+12 -12) 📝 `pnpm-lock.yaml` (+1888 -1439) _...and 1 more files_ </details> ### 📄 Description    Closes BE-688  ### What's changed  This pull request primarily updates dependency versions across the project, focusing on improving security and stability. The changes include upgrades to several core libraries, Docker base images, and build tools to address recent CVEs and ensure compatibility with the latest releases. **Dependency upgrades for backend and build process:** * Upgraded multiple dependencies in `packages/hoppscotch-backend/package.json`, including `@nestjs/*`, `@prisma/*`, `nodemailer`, `cookie`, `express`, `class-validator`, and several devDependencies, to their latest patch or minor versions for improved security and compatibility. [[1]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529L42-R58) [[2]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529L68-R113) * Updated overrides in the root `package.json` for packages such as `body-parser`, `jws`, `nodemailer`, and removed overrides for older versions, ensuring the use of patched versions and resolving vulnerabilities. **Dependency upgrades across other packages:** * Updated non-major dependencies across `hoppscotch-agent`, `hoppscotch-cli`, `hoppscotch-common`, `hoppscotch-data`, `hoppscotch-desktop`, and `hoppscotch-js-sandbox` packages. * Bumped frontend tooling including Vue.js ecosystem packages (`@vueuse/core`, `vue-router`, `@codemirror/view`), build tools (`vite`, `sass`, `autoprefixer`), and development tools (`@typescript-eslint`, `prettier`, `eslint`, `vitest`). * Updated GraphQL code generation dependencies (`@graphql-codegen` packages) and security-focused packages (`jose`, `dompurify`, `xmlbuilder2`). **Dockerfile and build environment enhancements:** * Updated the base Alpine Linux image in `prod.Dockerfile` from `3.22.2` to `3.23.0` for both Caddy and Node.js build stages, improving security and package availability. [[1]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L3-R3) [[2]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L48-L79) * Upgraded Go version to `1.25.5` and patched dependencies (`smallstep/certificates`, `x/crypto`) in the Caddy build stage to address recent CVEs. [[1]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L17-R17) [[2]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7R36-R37) * Updated NPM to `11.6.4` and PNPM to `10.25.0` in the Node.js build stage, and improved the process for patching the vulnerable `glob` package. These updates collectively enhance the project's security posture and ensure compatibility with the latest upstream releases.  ### Notes to reviewers  Nil  --- ## Summary by cubic Security patch release that updates backend dependencies and the Docker build chain to resolve recent CVEs and improve stability. Addresses Linear BE-688. - **Dependencies** - Bumped backend packages (NestJS, Prisma, Express 5.2.1, cookie 1.1.1, class-validator 0.14.3, nodemailer 7.0.11, posthog-node 5.17.2) and dev tools (ESLint, Nest CLI, Prettier, ts-jest). - Updated root overrides to enforce patched versions (body-parser 2.2.1, jws 3.2.3, nodemailer 7.0.11) and removed outdated overrides. - Refreshed pnpm-lock.yaml. - **Docker/build** - Upgraded Alpine to 3.23.0 for Caddy and Node stages. - Moved to Go 1.25.5 and patched deps (x/crypto v0.45.0, smallstep/certificates v0.29.0); rebuilt Caddy. - Updated npm to 11.6.4 and pnpm to 10.25.0; globally patched glob to 11.1.0. <sup>Written for commit e022eecf06f30689f2adc85700196e23edf24ad4. Summary will update automatically on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>