[PR #5710] [MERGED] chore: security patch for the quic-go vulnerability #5321

New issue

Closed

opened 2026-03-17 02:46:54 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:46:54 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5710
Author: @mirarifhasan
Created: 12/18/2025
Status: ✅ Merged
Merged: 12/19/2025
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-fix-2025-12-0-v2

📝 Commits (4)

9815ee9 build: update quic-go to v0.57.0 in Dockerfile
d653bb9 chore: bump non-major dependencies across packages
2a11761 build: update dependencies and CVE references
55f325f chore: changes in pnpm-lock.yaml file

📊 Changes

19 files changed (+1631 additions, -1558 deletions)

View changed files

📝 package.json (+1 -1)
📝 packages/codemirror-lang-graphql/package.json (+1 -1)
📝 packages/hoppscotch-agent/package.json (+5 -5)
📝 packages/hoppscotch-backend/package.json (+12 -12)
📝 packages/hoppscotch-cli/package.json (+3 -3)
📝 packages/hoppscotch-common/package.json (+16 -16)
📝 packages/hoppscotch-common/src/services/context-menu/menu/__tests__/parameter.menu.spec.ts (+34 -46)
📝 packages/hoppscotch-common/src/services/context-menu/menu/parameter.menu.ts (+1 -1)
📝 packages/hoppscotch-data/package.json (+1 -1)
📝 packages/hoppscotch-desktop/package.json (+7 -7)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json (+1 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json (+1 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json (+1 -1)
📝 packages/hoppscotch-js-sandbox/package.json (+5 -5)
📝 packages/hoppscotch-kernel/package.json (+1 -1)
📝 packages/hoppscotch-selfhost-web/package.json (+10 -10)
📝 packages/hoppscotch-sh-admin/package.json (+13 -13)
📝 pnpm-lock.yaml (+1516 -1431)
📝 prod.Dockerfile (+2 -2)

📄 Description

Closes #

What's changed

This pull request updates the quic-go dependency in the prod.Dockerfile to address a security vulnerability.

Dependency and security updates:

Upgraded github.com/quic-go/quic-go from version v0.55.0 to v0.57.0 to resolve CVE-2025-59530. (prod.Dockerfile)

Notes to reviewers

Nil

Summary by cubic

Updates quic-go to v0.57.0 in prod.Dockerfile to fix CVE-2025-64702. Production images now build with the patched version and the parameter context menu ID is corrected.

Bug Fixes
- ParameterMenuService: set context-menu item id to "parameter" and updated tests.
Dependencies
- Vue 3.5.26, lodash-es 4.17.22
- Vite 7.3.0, Rollup 4.53.5
- ESLint 9.39.2, TypeScript-ESLint 8.50.0
- Autoprefixer 10.4.23, Sass 1.97.0
- GraphQL Codegen packages and Vitest minor/patch updates

^{Written for commit 55f325f2e7. Summary will update automatically on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5710 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 12/18/2025 **Status:** ✅ Merged **Merged:** 12/19/2025 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-fix-2025-12-0-v2` --- ### 📝 Commits (4) - [`9815ee9`](https://github.com/hoppscotch/hoppscotch/commit/9815ee9eed680d7a370f5ec680a8a0f3ff42c6d6) build: update quic-go to v0.57.0 in Dockerfile - [`d653bb9`](https://github.com/hoppscotch/hoppscotch/commit/d653bb92cb158587ca5d27f9a28b40af4c0ca140) chore: bump non-major dependencies across packages - [`2a11761`](https://github.com/hoppscotch/hoppscotch/commit/2a117619d624f234e961aba0779efea68db41e6f) build: update dependencies and CVE references - [`55f325f`](https://github.com/hoppscotch/hoppscotch/commit/55f325f2e7fdfedcb1ef9d7843c958c966de2b03) chore: changes in pnpm-lock.yaml file ### 📊 Changes **19 files changed** (+1631 additions, -1558 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+1 -1) 📝 `packages/codemirror-lang-graphql/package.json` (+1 -1) 📝 `packages/hoppscotch-agent/package.json` (+5 -5) 📝 `packages/hoppscotch-backend/package.json` (+12 -12) 📝 `packages/hoppscotch-cli/package.json` (+3 -3) 📝 `packages/hoppscotch-common/package.json` (+16 -16) 📝 `packages/hoppscotch-common/src/services/context-menu/menu/__tests__/parameter.menu.spec.ts` (+34 -46) 📝 `packages/hoppscotch-common/src/services/context-menu/menu/parameter.menu.ts` (+1 -1) 📝 `packages/hoppscotch-data/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/package.json` (+7 -7) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json` (+1 -1) 📝 `packages/hoppscotch-js-sandbox/package.json` (+5 -5) 📝 `packages/hoppscotch-kernel/package.json` (+1 -1) 📝 `packages/hoppscotch-selfhost-web/package.json` (+10 -10) 📝 `packages/hoppscotch-sh-admin/package.json` (+13 -13) 📝 `pnpm-lock.yaml` (+1516 -1431) 📝 `prod.Dockerfile` (+2 -2) </details> ### 📄 Description   Closes #   ### What's changed This pull request updates the `quic-go` dependency in the `prod.Dockerfile` to address a security vulnerability. Dependency and security updates: * Upgraded `github.com/quic-go/quic-go` from version `v0.55.0` to `v0.57.0` to resolve CVE-2025-59530. (`prod.Dockerfile`)  ### Notes to reviewers  Nil  --- ## Summary by cubic Updates quic-go to v0.57.0 in prod.Dockerfile to fix CVE-2025-64702. Production images now build with the patched version and the parameter context menu ID is corrected. - **Bug Fixes** - ParameterMenuService: set context-menu item id to "parameter" and updated tests. - **Dependencies** - Vue 3.5.26, lodash-es 4.17.22 - Vite 7.3.0, Rollup 4.53.5 - ESLint 9.39.2, TypeScript-ESLint 8.50.0 - Autoprefixer 10.4.23, Sass 1.97.0 - GraphQL Codegen packages and Vitest minor/patch updates <sup>Written for commit 55f325f2e7fdfedcb1ef9d7843c958c966de2b03. Summary will update automatically on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>