[PR #5786] [MERGED] chore: security patch for the dependency chain v2026.1.0 #5348

New issue

Closed

opened 2026-03-17 02:48:15 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:48:15 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5786
Author: @mirarifhasan
Created: 1/20/2026
Status: ✅ Merged
Merged: 1/21/2026
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-fix-2025-1-0

📝 Commits (4)

9795e08 chore: update backend dependencies and devDependencies
0489cf8 chore: update dependencies and patch vulnerabilities in Dockerfile
fcec5a0 chore: enable depends_on for frontend and admin services
75f0c2f chore: bump non-major dependencies across packages

📊 Changes

18 files changed (+2756 additions, -1874 deletions)

View changed files

📝 docker-compose.yml (+4 -4)
📝 package.json (+8 -6)
📝 packages/codemirror-lang-graphql/package.json (+1 -1)
📝 packages/hoppscotch-agent/package.json (+6 -6)
📝 packages/hoppscotch-backend/package.json (+17 -17)
📝 packages/hoppscotch-cli/package.json (+3 -3)
📝 packages/hoppscotch-common/package.json (+17 -17)
📝 packages/hoppscotch-data/package.json (+2 -2)
📝 packages/hoppscotch-desktop/package.json (+8 -8)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json (+1 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json (+1 -1)
📝 packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json (+1 -1)
📝 packages/hoppscotch-js-sandbox/package.json (+11 -11)
📝 packages/hoppscotch-kernel/package.json (+4 -4)
📝 packages/hoppscotch-selfhost-web/package.json (+9 -9)
📝 packages/hoppscotch-sh-admin/package.json (+8 -8)
📝 pnpm-lock.yaml (+2631 -1766)
📝 prod.Dockerfile (+24 -9)

📄 Description

Closes BE-708

What's changed

Security patch across the Docker build and Node backend to address CVEs and keep dependencies on safe minor versions. Upgrades Alpine, Go, npm/pnpm, and several backend libraries to reduce risk without functional changes.

Dependencies
- Docker: Alpine 3.23.2, Go 1.25.6, npm 11.7.0, pnpm 10.28.1; patched glob@11.1.0, tar@7.5.3, diff@8.0.3 and replaced them inside npm and @import-meta-env to address CVE-2025-64756, CVE-2026-23745, GHSA-73rr-hh4g-fpgx.
- Backend: bumped NestJS (common/core/platform-express to 11.1.12, swagger 11.2.5), nodemailer 7.0.12, pg 8.17.1, posthog-node 5.23.0; updated dev tooling (eslint/types/prettier/supertest).
- Root: set packageManager to pnpm 10.28.1; upgraded hono to 4.11.4 and qs to 6.14.1; ensured consistent glob and form-data versions.
- Regenerated pnpm-lock.yaml for the updated dependency graph.

Notes to reviewers

Nil

Summary by cubic

Security patch across the Docker build and Node backend to address CVEs and keep dependencies on safe minor versions (BE-708). Upgrades Alpine, Go, npm/pnpm, and several backend libraries to reduce risk without user-facing changes.

Dependencies
- Docker: Alpine 3.23.2, Go 1.25.6, npm 11.7.0, pnpm 10.28.1; patched glob@11.1.0, tar@7.5.3, diff@8.0.3 and replaced them inside npm and @import-meta-env to address CVE-2025-64756, CVE-2026-23745, GHSA-73rr-hh4g-fpgx.
- Backend: bumped NestJS (common/core/platform-express to 11.1.12, swagger 11.2.5), nodemailer 7.0.12, pg 8.17.1, posthog-node 5.23.0; updated dev tooling (eslint/types/prettier/supertest).
- Root: set packageManager to pnpm 10.28.1; upgraded hono to 4.11.4 and qs to 6.14.1; ensured consistent glob and form-data versions.
- Regenerated pnpm-lock.yaml for the updated dependency graph.
Refactors
- Enabled depends_on in docker-compose for frontend and admin to wait for the backend at startup.

^{Written for commit 75f0c2f8de. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5786 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 1/20/2026 **Status:** ✅ Merged **Merged:** 1/21/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-fix-2025-1-0` --- ### 📝 Commits (4) - [`9795e08`](https://github.com/hoppscotch/hoppscotch/commit/9795e0876752e798f7d48de9fb9e3a08fcbfac67) chore: update backend dependencies and devDependencies - [`0489cf8`](https://github.com/hoppscotch/hoppscotch/commit/0489cf89899e80949423a22361e9ef252cb82211) chore: update dependencies and patch vulnerabilities in Dockerfile - [`fcec5a0`](https://github.com/hoppscotch/hoppscotch/commit/fcec5a0b9babc264d8b6c2a7e8303650df8ea752) chore: enable depends_on for frontend and admin services - [`75f0c2f`](https://github.com/hoppscotch/hoppscotch/commit/75f0c2f8de925873cccf168a87372006da4055ba) chore: bump non-major dependencies across packages ### 📊 Changes **18 files changed** (+2756 additions, -1874 deletions) <details> <summary>View changed files</summary> 📝 `docker-compose.yml` (+4 -4) 📝 `package.json` (+8 -6) 📝 `packages/codemirror-lang-graphql/package.json` (+1 -1) 📝 `packages/hoppscotch-agent/package.json` (+6 -6) 📝 `packages/hoppscotch-backend/package.json` (+17 -17) 📝 `packages/hoppscotch-cli/package.json` (+3 -3) 📝 `packages/hoppscotch-common/package.json` (+17 -17) 📝 `packages/hoppscotch-data/package.json` (+2 -2) 📝 `packages/hoppscotch-desktop/package.json` (+8 -8) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/examples/tauri-app/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-appload/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/plugin-workspace/tauri-plugin-relay/package.json` (+1 -1) 📝 `packages/hoppscotch-js-sandbox/package.json` (+11 -11) 📝 `packages/hoppscotch-kernel/package.json` (+4 -4) 📝 `packages/hoppscotch-selfhost-web/package.json` (+9 -9) 📝 `packages/hoppscotch-sh-admin/package.json` (+8 -8) 📝 `pnpm-lock.yaml` (+2631 -1766) 📝 `prod.Dockerfile` (+24 -9) </details> ### 📄 Description    Closes BE-708  ### What's changed  Security patch across the Docker build and Node backend to address CVEs and keep dependencies on safe minor versions. Upgrades Alpine, Go, npm/pnpm, and several backend libraries to reduce risk without functional changes. - **Dependencies** - Docker: Alpine 3.23.2, Go 1.25.6, npm 11.7.0, pnpm 10.28.1; patched glob@11.1.0, tar@7.5.3, diff@8.0.3 and replaced them inside npm and @import-meta-env to address CVE-2025-64756, CVE-2026-23745, GHSA-73rr-hh4g-fpgx. - Backend: bumped NestJS (common/core/platform-express to 11.1.12, swagger 11.2.5), nodemailer 7.0.12, pg 8.17.1, posthog-node 5.23.0; updated dev tooling (eslint/types/prettier/supertest). - Root: set packageManager to pnpm 10.28.1; upgraded hono to 4.11.4 and qs to 6.14.1; ensured consistent glob and form-data versions. - Regenerated pnpm-lock.yaml for the updated dependency graph.  ### Notes to reviewers  Nil  --- ## Summary by cubic Security patch across the Docker build and Node backend to address CVEs and keep dependencies on safe minor versions (BE-708). Upgrades Alpine, Go, npm/pnpm, and several backend libraries to reduce risk without user-facing changes. - **Dependencies** - Docker: Alpine 3.23.2, Go 1.25.6, npm 11.7.0, pnpm 10.28.1; patched glob@11.1.0, tar@7.5.3, diff@8.0.3 and replaced them inside npm and @import-meta-env to address CVE-2025-64756, CVE-2026-23745, GHSA-73rr-hh4g-fpgx. - Backend: bumped NestJS (common/core/platform-express to 11.1.12, swagger 11.2.5), nodemailer 7.0.12, pg 8.17.1, posthog-node 5.23.0; updated dev tooling (eslint/types/prettier/supertest). - Root: set packageManager to pnpm 10.28.1; upgraded hono to 4.11.4 and qs to 6.14.1; ensured consistent glob and form-data versions. - Regenerated pnpm-lock.yaml for the updated dependency graph. - **Refactors** - Enabled depends_on in docker-compose for frontend and admin to wait for the backend at startup. <sup>Written for commit 75f0c2f8de925873cccf168a87372006da4055ba. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>