[PR #5887] [MERGED] chore: security patch for the dependency chain `v2026.2.0` #5391

New issue

Closed

opened 2026-03-17 02:50:41 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:50:41 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5887
Author: @mirarifhasan
Created: 2/17/2026
Status: ✅ Merged
Merged: 2/19/2026
Merged by: @jamesgeorge007

Base: next ← Head: chore/security-fix-2026-2-0

📝 Commits (4)

2fd6fdb chore: bump dependency versions and update lockfile
164b469 chore: verify Go tarball checksum in Dockerfile
28a4ae2 chore: pin form-data and harden Docker build
03a6da3 chore: bump non-major dependencies across packages

📊 Changes

13 files changed (+2848 additions, -5375 deletions)

View changed files

📝 package.json (+8 -8)
📝 packages/hoppscotch-agent/package.json (+11 -11)
📝 packages/hoppscotch-backend/package.json (+27 -27)
📝 packages/hoppscotch-cli/package.json (+7 -7)
📝 packages/hoppscotch-common/package.json (+26 -26)
📝 packages/hoppscotch-data/package.json (+1 -1)
📝 packages/hoppscotch-desktop/package.json (+10 -10)
📝 packages/hoppscotch-js-sandbox/package.json (+6 -6)
📝 packages/hoppscotch-kernel/package.json (+3 -3)
📝 packages/hoppscotch-selfhost-web/package.json (+17 -17)
📝 packages/hoppscotch-sh-admin/package.json (+18 -18)
📝 pnpm-lock.yaml (+2675 -5200)
📝 prod.Dockerfile (+39 -41)

📄 Description

Closes BE-716, FE-1131.

What's changed

This pull request primarily updates dependencies across the backend and Docker build files to address vulnerabilities and keep the stack current. The most significant changes include updating the Go and Node.js base images, bumping various package versions (including security-related ones), and restructuring the Dockerfile build stages for improved clarity and maintainability.

Dockerfile and build process improvements:

Upgraded the Go base image to alpine:3.23.3 and Go version to 1.26.0 (from 1.25.6), addressing CVE-2025-47907, and restructured the Dockerfile to separate the Caddy build stage for better clarity and maintainability. [1] [2]
Updated the Node.js base image to alpine:3.23.3, upgraded NPM to 11.10.0 (from 11.7.0), and PNPM to 10.29.3 (from 10.28.1), and simplified the vulnerability patching steps for glob, tar, and diff dependencies.

Backend and dependency updates:

Updated multiple backend dependencies in packages/hoppscotch-backend/package.json, including major/minor bumps for @nestjs/*, @prisma/*, nodemailer, pg, dotenv, posthog-node, prisma, and various dev dependencies, ensuring improved security and compatibility. [1] [2]
Updated main package.json to bump versions for hono, lodash, nodemailer, qs, and adjust version ranges for some dependencies, keeping the stack up to date and secure.

Notes to reviewers

Nil

Summary by cubic

Security patch for the dependency chain to reduce CVE exposure and modernize build/runtime images. Addresses BE-716 by upgrading Go/Node bases, adding checksum verification, pinning risky packages, and updating backend, frontend, and root dependencies.

Dependencies
- Backend: bumped NestJS, Prisma 7.4, pg 8.18, nodemailer 8.0.1, dotenv 17.3.1, express-session 1.19.0, posthog-node 5.24.x, and lint/test tooling (eslint 10.0.0, @eslint/js 10.0.1, ts-eslint 8.56, prettier 3.8.1).
- Apps/packages: refreshed axios 1.13.5, lodash/lodash-es 4.17.23, vue 3.5.28, qs 6.15.0, codegen/vite plugins; minor bumps across common, cli, desktop, kernel, selfhost-web, sh-admin, js-sandbox.
- Root: updated hono 4.11.7, lodash 4.17.23, qs 6.14.2; pinned form-data 4.0.4; set nodemailer 7.0.11 override; tightened execa (<2.0.0 ⇒ 2.0.0), keep glob 11.1.0; refreshed pnpm lockfile.
Refactors
- prod.Dockerfile: Alpine 3.23.3 and Go 1.26.0; added checksum verification for Go tarball and Caddy source; split Caddy stage; vendored deps and kept quic-go/crypto/smallstep patches; dropped nebula patch.
- Node base: npm 11.10.0, pnpm 10.29.3; keep glob@11.1.0 and replace tar with 7.5.8 (propagated to npm and pnpm); removed diff replacement; simplified and hardened build steps.

^{Written for commit 03a6da3828. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5887 **Author:** [@mirarifhasan](https://github.com/mirarifhasan) **Created:** 2/17/2026 **Status:** ✅ Merged **Merged:** 2/19/2026 **Merged by:** [@jamesgeorge007](https://github.com/jamesgeorge007) **Base:** `next` ← **Head:** `chore/security-fix-2026-2-0` --- ### 📝 Commits (4) - [`2fd6fdb`](https://github.com/hoppscotch/hoppscotch/commit/2fd6fdbdb4bd98c7becb708753174124839f2c91) chore: bump dependency versions and update lockfile - [`164b469`](https://github.com/hoppscotch/hoppscotch/commit/164b469b3ccc3b06d517b39c9f819e1e5202fd6e) chore: verify Go tarball checksum in Dockerfile - [`28a4ae2`](https://github.com/hoppscotch/hoppscotch/commit/28a4ae213978cdcc3fbf8ca03c69902401128bc8) chore: pin form-data and harden Docker build - [`03a6da3`](https://github.com/hoppscotch/hoppscotch/commit/03a6da38283339bec22083a06c41657112c03bd4) chore: bump non-major dependencies across packages ### 📊 Changes **13 files changed** (+2848 additions, -5375 deletions) <details> <summary>View changed files</summary> 📝 `package.json` (+8 -8) 📝 `packages/hoppscotch-agent/package.json` (+11 -11) 📝 `packages/hoppscotch-backend/package.json` (+27 -27) 📝 `packages/hoppscotch-cli/package.json` (+7 -7) 📝 `packages/hoppscotch-common/package.json` (+26 -26) 📝 `packages/hoppscotch-data/package.json` (+1 -1) 📝 `packages/hoppscotch-desktop/package.json` (+10 -10) 📝 `packages/hoppscotch-js-sandbox/package.json` (+6 -6) 📝 `packages/hoppscotch-kernel/package.json` (+3 -3) 📝 `packages/hoppscotch-selfhost-web/package.json` (+17 -17) 📝 `packages/hoppscotch-sh-admin/package.json` (+18 -18) 📝 `pnpm-lock.yaml` (+2675 -5200) 📝 `prod.Dockerfile` (+39 -41) </details> ### 📄 Description    Closes BE-716, FE-1131.  ### What's changed  This pull request primarily updates dependencies across the backend and Docker build files to address vulnerabilities and keep the stack current. The most significant changes include updating the Go and Node.js base images, bumping various package versions (including security-related ones), and restructuring the Dockerfile build stages for improved clarity and maintainability. **Dockerfile and build process improvements:** * Upgraded the Go base image to `alpine:3.23.3` and Go version to `1.26.0` (from `1.25.6`), addressing CVE-2025-47907, and restructured the Dockerfile to separate the Caddy build stage for better clarity and maintainability. [[1]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7L4-R8) [[2]](diffhunk://#diff-93deb24e09c3e11b921d0bcea79e1f81ba10affde06fe5ab82a3c5c10e3b48e7R19-R30) * Updated the Node.js base image to `alpine:3.23.3`, upgraded NPM to `11.10.0` (from `11.7.0`), and PNPM to `10.29.3` (from `10.28.1`), and simplified the vulnerability patching steps for `glob`, `tar`, and `diff` dependencies. **Backend and dependency updates:** * Updated multiple backend dependencies in `packages/hoppscotch-backend/package.json`, including major/minor bumps for `@nestjs/*`, `@prisma/*`, `nodemailer`, `pg`, `dotenv`, `posthog-node`, `prisma`, and various dev dependencies, ensuring improved security and compatibility. [[1]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529L34-R59) [[2]](diffhunk://#diff-f95930a2c3d53c2408a125ce8083496e5d3b45a7b097fb957dc7a6b6250d5529L68-R110) * Updated main `package.json` to bump versions for `hono`, `lodash`, `nodemailer`, `qs`, and adjust version ranges for some dependencies, keeping the stack up to date and secure.  ### Notes to reviewers  Nil  --- ## Summary by cubic Security patch for the dependency chain to reduce CVE exposure and modernize build/runtime images. Addresses BE-716 by upgrading Go/Node bases, adding checksum verification, pinning risky packages, and updating backend, frontend, and root dependencies. - **Dependencies** - Backend: bumped NestJS, Prisma 7.4, pg 8.18, nodemailer 8.0.1, dotenv 17.3.1, express-session 1.19.0, posthog-node 5.24.x, and lint/test tooling (eslint 10.0.0, @eslint/js 10.0.1, ts-eslint 8.56, prettier 3.8.1). - Apps/packages: refreshed axios 1.13.5, lodash/lodash-es 4.17.23, vue 3.5.28, qs 6.15.0, codegen/vite plugins; minor bumps across common, cli, desktop, kernel, selfhost-web, sh-admin, js-sandbox. - Root: updated hono 4.11.7, lodash 4.17.23, qs 6.14.2; pinned form-data 4.0.4; set nodemailer 7.0.11 override; tightened execa (<2.0.0 ⇒ 2.0.0), keep glob 11.1.0; refreshed pnpm lockfile. - **Refactors** - prod.Dockerfile: Alpine 3.23.3 and Go 1.26.0; added checksum verification for Go tarball and Caddy source; split Caddy stage; vendored deps and kept quic-go/crypto/smallstep patches; dropped nebula patch. - Node base: npm 11.10.0, pnpm 10.29.3; keep glob@11.1.0 and replace tar with 7.5.8 (propagated to npm and pnpm); removed diff replacement; simplified and hardened build steps. <sup>Written for commit 03a6da38283339bec22083a06c41657112c03bd4. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>