Chore/security OSV triage safe upgrades#95
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates backend and frontend dependencies to incorporate security/stability fixes and keep the project aligned with upstream patch releases.
Changes:
- Bumps Go toolchain image/tag and refreshes Go module dependencies (
pgx,quic-go, etc.). - Updates UI dependencies including
axiosandvite, with correspondingpackage-lock.jsonrefresh. - Pulls in various indirect dependency updates (e.g.,
postcss,brace-expansion,follow-redirects,proxy-from-env).
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
api/go.mod |
Updates Go version directive and several indirect module versions. |
api/go.sum |
Updates module checksums to match refreshed dependencies. |
api/Dockerfile |
Bumps Go builder image patch version. |
ui/package.json |
Updates direct npm dependency versions (axios, vite). |
ui/package-lock.json |
Updates resolved npm dependency graph for the bumped packages. |
Files not reviewed (1)
- ui/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
nazarli-shabnam
commented
May 1, 2026
…/security-osv-triage-safe-upgrades
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- ui/package-lock.json: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR implements comprehensive security hardening across the platform: session eviction on password operations to protect compromised accounts, instance-admin authorization for settings endpoints with secret sanitization to prevent plaintext leakage, email verification enforcement in OAuth providers, role-based access control tightened across workspace/project/integration services, cross-workspace issue validation in module and cycle operations, frontend XSS/URL injection defenses through HTML and URL sanitization, and a new instance admin management interface. Dependency versions are also updated (Go 1.26.4, pgx, quic-go, DOMPurify, Vite). ChangesSecurity Hardening and Authorization Enforcement
Estimated code review effort🎯 4 (Complex) | ⏱️ ~75 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Member
Author
Code reviewNo issues found. This PR is scoped purely to dependency and toolchain upgrades (OSV-triage safe upgrades); there are no application-logic changes, so no new behavioral or security surface is introduced. I resolved the outstanding merge conflicts with What changed and why it is valid
Verification performed
Branch is now |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
api/internal/service/github_sync.go (1)
143-150: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winAuthorize before loading the sync row.
GetByProjectcan returnErrRepoSyncNotFoundbefore the new admin checks run, so non-admin workspace members can infer whether a project has a GitHub sync. MirrorCreateSync: resolve the workspace/project and enforceRoleAdminbefore loading the sync record.Also applies to: 204-211
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/service/github_sync.go` around lines 143 - 150, The UpdateSync function currently calls GetByProject before performing the admin authorization check, which allows non-admin users to infer whether a GitHub sync exists by observing the ErrRepoSyncNotFound error. Move the authorization check earlier in the UpdateSync function by first resolving the workspace/project details and enforcing the RoleAdmin check before calling GetByProject, mirroring the pattern used in the CreateSync method. This ensures that unauthorized users receive an ErrWorkspaceForbidden error regardless of whether the sync record exists.
🧹 Nitpick comments (3)
api/internal/handler/instance_test.go (1)
126-130: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAssert the PATCH response is sanitized too.
Line 126 stores the secret, but the test only checks the later GET response. Since
UpdateSettingnow sanitizes its immediate PATCH response as well, assert thatrrdoes not echosuper-secret.🧪 Proposed test hardening
rr := ts.PATCH("/api/instance/settings/email", map[string]any{ "value": map[string]any{"host": "smtp.example.com", "password": "super-secret"}, }, session) require.Equal(t, http.StatusOK, rr.Code, "body=%s", rr.Body.String()) + assert.NotContains(t, rr.Body.String(), "super-secret") + patchBody := testutil.MustJSONMap(t, rr) + patchValue, _ := patchBody["value"].(map[string]any) + require.NotNil(t, patchValue) + assert.Equal(t, "", patchValue["password"]) + assert.Equal(t, true, patchValue["password_set"]) // GET must never echo the plaintext secret back — only password_set.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/handler/instance_test.go` around lines 126 - 130, The test for the PATCH request to "/api/instance/settings/email" only verifies the HTTP status code but does not assert that sensitive data is sanitized in the response body. After the PATCH call that sends the password "super-secret", add an assertion to verify that the response body (rr.Body.String()) does not contain the sensitive password value "super-secret", ensuring the UpdateSetting endpoint properly sanitizes its immediate response.api/internal/model/workspace.go (1)
29-36: 🔒 Security & Privacy | 🔵 TrivialConsolidate role constants: replace
testutil.Role*withmodel.Role*imports.The role constants are duplicated in
api/internal/testutil/factory.go(lines 141–144) with identical values, but tests actively referencetestutil.RoleMember,testutil.RoleAdmin, etc. instead of importing from themodelpackage. If the testutil constants drift from model constants in a future update, tests will silently pass with incorrect authorization thresholds. Replace the testutil definitions with imports frommodeland update test files to usemodel.Role*.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/model/workspace.go` around lines 29 - 36, The role constants RoleGuest, RoleMember, RoleAdmin, and RoleOwner are duplicated in both the model package (workspace.go) and the testutil package (factory.go) with identical values, creating a maintenance risk if they diverge. Remove the duplicate role constant definitions from the testutil package and instead import these constants from the model package. Then update all test files that currently reference testutil.RoleGuest, testutil.RoleMember, testutil.RoleAdmin, and testutil.RoleOwner to use model.RoleGuest, model.RoleMember, model.RoleAdmin, and model.RoleOwner respectively, ensuring a single source of truth for authorization thresholds.api/internal/oauth/github.go (1)
66-68: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPreserve GitHub email lookup failures instead of reporting all of them as unverified.
Line 67 converts network errors, non-2xx responses, malformed JSON, and “no verified email” into the same
ErrEmailNotVerified, which makes GitHub OAuth outages or scope/config issues hard to diagnose now that this lookup is mandatory.♻️ Proposed fix
email, err := g.fetchPrimaryEmail(ctx, token.AccessToken) - if err != nil || email == "" { + if err != nil { + return nil, err + } + if email == "" { return nil, ErrEmailNotVerified }defer resp.Body.Close() - body, _ := io.ReadAll(resp.Body) + if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices { + return "", fmt.Errorf("github email lookup failed: status %d", resp.StatusCode) + } + body, err := io.ReadAll(resp.Body) + if err != nil { + return "", err + } var emails []struct { Email string `json:"email"` Primary bool `json:"primary"` Verified bool `json:"verified"` @@ - return "", fmt.Errorf("no verified email found") + return "", ErrEmailNotVerified }Also applies to: 104-110
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/oauth/github.go` around lines 66 - 68, The error handling in the GitHub OAuth flow is masking all errors from the fetchPrimaryEmail method call as ErrEmailNotVerified, making it difficult to diagnose network failures, scope issues, or API problems. Instead of treating all errors the same, you need to preserve the actual error returned by fetchPrimaryEmail and only return ErrEmailNotVerified when the error is specifically about no verified email being found. Check if the error is nil and email is empty, then return the actual error; only return ErrEmailNotVerified when appropriate. Apply the same fix to the similar pattern mentioned at lines 104-110.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/internal/auth/service.go`:
- Around line 278-280: The session deletion error from DeleteByUserIDExcept is
being silently ignored using the blank identifier, which means failed session
evictions are not detected and the operation still reports success to the
caller. Remove the blank identifier and instead capture the error return value
from the DeleteByUserIDExcept call in the sessionStore deletion block. Check if
an error is returned and propagate it back to the caller so that password
changes or account recovery operations fail appropriately when session eviction
fails. Apply this same fix to all occurrences of this pattern throughout the
service file where sessionStore.DeleteByUserIDExcept is called.
In `@api/internal/config/config.go`:
- Around line 109-113: The validation checks for MAGIC_CODE_SECRET and
INSTANCE_ENCRYPTION_KEY at lines 109-113 only reject empty strings but not
whitespace-only strings. Use strings.TrimSpace() to trim whitespace from these
environment variables before checking if they are empty, so that values
containing only spaces are correctly rejected as missing. Keep the original
untrimmed values for actual use, only trim them for the validation check. Ensure
the strings package is imported in the imports section.
In `@api/internal/oauth/google.go`:
- Around line 66-70: The email verification check in the Google OAuth handler is
not implementing fail-closed security. Currently, the code block checking the
verified_email field only rejects when the value is explicitly false, but if the
field is missing or not a boolean type, the code continues and links the email
anyway. Refactor the conditional logic around the verified_email field check to
ensure the code returns ErrEmailNotVerified unless verified_email is both
present and explicitly true. This means any case where the field is missing, has
a non-boolean value, or is false should be treated as unverified.
In `@api/internal/service/attachment.go`:
- Around line 76-83: The `ensureIssueAccess` method currently returns
`ErrAttachmentNotFound` for all three conditions (when `s.is.GetByID` returns an
error, when issue is nil, or when project IDs don't match), which masks
unexpected store errors and conflicts with the handler's error mapping logic
that only translates project-level errors to 404. Modify the method to return
the actual error from `s.is.GetByID` when it occurs (to surface real store
errors), and only return `ErrAttachmentNotFound` when the issue is nil or the
project ID doesn't match. This aligns the service/handler contract so legitimate
not-found scenarios are properly distinguished from unexpected errors.
In `@api/internal/service/cycle.go`:
- Around line 189-191: The GetByID call in AddCycleIssue currently returns
ErrIssueNotFound for all errors, including transient database failures. Refactor
the error handling to first check if err is not nil and propagate that error
directly, then separately check if issue is nil or issue.ProjectID does not
match projectID to return ErrIssueNotFound only for those true missing or
mismatched cases.
In `@api/internal/service/module.go`:
- Around line 163-165: The issue validation in the GetByID call is masking all
errors as ErrIssueNotFound, including real storage and runtime failures. Modify
the condition to differentiate between actual not-found scenarios and other
errors: return the actual error from s.is.GetByID when it represents a real
storage/runtime failure, and only return ErrIssueNotFound when the issue is
genuinely missing (when issue is nil) or when the issue.ProjectID does not match
the expected projectID. This preserves diagnostic information for actual system
failures while still correctly handling the 404 case for missing issues.
In `@api/internal/service/project.go`:
- Around line 200-211: The code assigns a role value to a project member without
validating that the caller has permission to grant that role level. Before the
line where m.Role is assigned in this section, retrieve the caller's role (the
user making the update), then validate that the role parameter is both a
valid/known role value and does not exceed the caller's role level, similar to
how workspace role validation works. Reject the operation with an appropriate
error if either validation fails.
In `@api/internal/service/workspace.go`:
- Around line 196-203: The first permission check only prevents non-owners from
changing the workspace owner's role, but it does not prevent the owner from
demoting themselves. This breaks the invariant that the workspace owner's role
must always remain as Owner. Add an additional check that prevents the owner
from being demoted by verifying that if the member being modified (m.MemberID)
is the workspace owner (w.OwnerID), the new role being assigned must be at the
Owner level or higher; if attempting to assign a role below Owner to the owner
themselves, return ErrWorkspaceForbidden.
In `@api/internal/store/session.go`:
- Around line 55-68: The DeleteByUserID and DeleteByUserIDExcept methods use
PostgreSQL-specific JSONB syntax (session_data::jsonb->>'user_id') that is
incompatible with SQLite used in tests. To fix this, refactor the session
filtering logic to be database-agnostic by either adding a dedicated user_id
column to the Session model and filtering directly on that column instead of
extracting from JSONB, or by using GORM query builders that automatically handle
dialect differences. This will ensure both methods work correctly in both
PostgreSQL and SQLite test environments when called from ResetPassword,
ChangePassword, or SetPassword.
---
Outside diff comments:
In `@api/internal/service/github_sync.go`:
- Around line 143-150: The UpdateSync function currently calls GetByProject
before performing the admin authorization check, which allows non-admin users to
infer whether a GitHub sync exists by observing the ErrRepoSyncNotFound error.
Move the authorization check earlier in the UpdateSync function by first
resolving the workspace/project details and enforcing the RoleAdmin check before
calling GetByProject, mirroring the pattern used in the CreateSync method. This
ensures that unauthorized users receive an ErrWorkspaceForbidden error
regardless of whether the sync record exists.
---
Nitpick comments:
In `@api/internal/handler/instance_test.go`:
- Around line 126-130: The test for the PATCH request to
"/api/instance/settings/email" only verifies the HTTP status code but does not
assert that sensitive data is sanitized in the response body. After the PATCH
call that sends the password "super-secret", add an assertion to verify that the
response body (rr.Body.String()) does not contain the sensitive password value
"super-secret", ensuring the UpdateSetting endpoint properly sanitizes its
immediate response.
In `@api/internal/model/workspace.go`:
- Around line 29-36: The role constants RoleGuest, RoleMember, RoleAdmin, and
RoleOwner are duplicated in both the model package (workspace.go) and the
testutil package (factory.go) with identical values, creating a maintenance risk
if they diverge. Remove the duplicate role constant definitions from the
testutil package and instead import these constants from the model package. Then
update all test files that currently reference testutil.RoleGuest,
testutil.RoleMember, testutil.RoleAdmin, and testutil.RoleOwner to use
model.RoleGuest, model.RoleMember, model.RoleAdmin, and model.RoleOwner
respectively, ensuring a single source of truth for authorization thresholds.
In `@api/internal/oauth/github.go`:
- Around line 66-68: The error handling in the GitHub OAuth flow is masking all
errors from the fetchPrimaryEmail method call as ErrEmailNotVerified, making it
difficult to diagnose network failures, scope issues, or API problems. Instead
of treating all errors the same, you need to preserve the actual error returned
by fetchPrimaryEmail and only return ErrEmailNotVerified when the error is
specifically about no verified email being found. Check if the error is nil and
email is empty, then return the actual error; only return ErrEmailNotVerified
when appropriate. Apply the same fix to the similar pattern mentioned at lines
104-110.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b52a6870-2fa1-4f2d-95a0-a901af689fe1
⛔ Files ignored due to path filters (1)
ui/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (26)
api/internal/auth/service.goapi/internal/config/config.goapi/internal/handler/auth.goapi/internal/handler/instance.goapi/internal/handler/instance_test.goapi/internal/handler/oauth_config.goapi/internal/model/workspace.goapi/internal/oauth/github.goapi/internal/oauth/google.goapi/internal/oauth/oauth.goapi/internal/router/router.goapi/internal/service/attachment.goapi/internal/service/cycle.goapi/internal/service/github_sync.goapi/internal/service/integration.goapi/internal/service/issue_view.goapi/internal/service/module.goapi/internal/service/project.goapi/internal/service/workspace.goapi/internal/store/session.goapi/internal/testutil/factory.goui/package.jsonui/src/lib/sanitize.tsui/src/pages/EpicDetailPage.tsxui/src/pages/IssueDetailPage.tsxui/src/pages/PageDetailPage.tsx
✅ Files skipped from review due to trivial changes (1)
- ui/src/lib/sanitize.ts
… role gate + manage endpoints
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
api/internal/handler/instance.go (1)
76-116: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftMake first-admin seeding fail-closed and atomic.
h.Admins.Createis best-effort here. If it fails, setup still returns201, but the created user makes future setup attempts hitcount > 0, leaving the instance without an admin for the newly gated settings. TheCount → SignUp → Create adminflow also lets concurrent setup requests seed multiple first admins. Wrap setup in a transaction/advisory lock or equivalent setup sentinel, requireh.Adminsto be configured before user creation, and return/rollback on admin seed failure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/handler/instance.go` around lines 76 - 116, The setup flow in the InstanceSetupRequest handler ignores the error from h.Admins.Create, which can leave the instance without an admin if the call fails, and concurrent requests can create multiple first admins. Replace the underscore error discard with proper error handling in the h.Admins.Create call to return an error response, require h.Admins to be non-nil before attempting user creation with h.Auth.SignUp, and wrap the entire flow (the h.Users.Count check through h.Admins.Create) in a database transaction or advisory lock to ensure atomicity and prevent concurrent setup requests from both succeeding.
🧹 Nitpick comments (1)
api/internal/testutil/factory.go (1)
131-134: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the model role constant in the fixture.
SeedInstanceAdmincreates amodel.InstanceAdmin, so usingmodel.RoleOwnerkeeps security tests aligned with the production authorization constants if testutil role aliases ever drift.♻️ Proposed fix
if err := store.NewInstanceAdminStore(db).Create(context.Background(), &model.InstanceAdmin{ UserID: user.ID, - Role: RoleOwner, + Role: model.RoleOwner, IsVerified: true, }); err != nil {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@api/internal/testutil/factory.go` around lines 131 - 134, In the SeedInstanceAdmin function (or the InstanceAdmin creation block), replace the testutil role alias RoleOwner with the production model constant model.RoleOwner when setting the Role field. This ensures that security tests use the actual authorization constants from the model package rather than testutil aliases, preventing potential misalignment if the aliases and production constants ever diverge.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@api/internal/handler/instance.go`:
- Around line 236-245: The current implementation has a race condition where two
concurrent requests can both observe count == 2 in the Count() call and proceed
to DeleteByPK(), leaving zero admins. Replace the separate h.Admins.Count() and
h.Admins.DeleteByPK() calls with a single atomic transactional method in the
Admins store (e.g., DeleteByPKIfAdminsRemain) that performs the count check and
deletion within a transaction, or uses a conditional delete query that fails if
it would remove the last admin, ensuring only one request succeeds when multiple
admins exist.
- Around line 212-216: The current role assignment logic in the InstanceAdmin
creation silently defaults to RoleOwner when an invalid role is provided or
promotes roles without proper validation. Replace the conditional check that
only validates if req.Role is greater than or equal to model.RoleAdmin with
explicit validation that rejects any invalid roles. Add validation logic that
checks if req.Role is provided and ensures it is one of the valid allowed roles
(such as explicitly checking against RoleAdmin and RoleOwner), returning an
error response if the role is invalid rather than silently accepting or
defaulting it. This prevents bad client input from over-granting permissions or
persisting invalid authorization states in the model.InstanceAdmin struct.
---
Outside diff comments:
In `@api/internal/handler/instance.go`:
- Around line 76-116: The setup flow in the InstanceSetupRequest handler ignores
the error from h.Admins.Create, which can leave the instance without an admin if
the call fails, and concurrent requests can create multiple first admins.
Replace the underscore error discard with proper error handling in the
h.Admins.Create call to return an error response, require h.Admins to be non-nil
before attempting user creation with h.Auth.SignUp, and wrap the entire flow
(the h.Users.Count check through h.Admins.Create) in a database transaction or
advisory lock to ensure atomicity and prevent concurrent setup requests from
both succeeding.
---
Nitpick comments:
In `@api/internal/testutil/factory.go`:
- Around line 131-134: In the SeedInstanceAdmin function (or the InstanceAdmin
creation block), replace the testutil role alias RoleOwner with the production
model constant model.RoleOwner when setting the Role field. This ensures that
security tests use the actual authorization constants from the model package
rather than testutil aliases, preventing potential misalignment if the aliases
and production constants ever diverge.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7fd99721-3b5e-4545-804d-8be9d59a3d15
📒 Files selected for processing (8)
api/internal/handler/instance.goapi/internal/handler/instance_test.goapi/internal/model/instance_admin.goapi/internal/router/router.goapi/internal/store/instance_admin.goapi/internal/testutil/factory.goapi/migrations/000006_instance_admins.down.sqlapi/migrations/000006_instance_admins.up.sql
✅ Files skipped from review due to trivial changes (2)
- api/migrations/000006_instance_admins.down.sql
- api/migrations/000006_instance_admins.up.sql
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ui/src/pages/instance-admin/InstanceAdminAdminsPage.tsx`:
- Line 112: The className on the email input field in InstanceAdminAdminsPage
contains focus:outline-none which removes the focus indicator without providing
a replacement visible focus state, breaking keyboard accessibility. Replace or
supplement the focus:outline-none class with appropriate focus styles (such as
focus:ring or focus:border styles) that provide a clear visual indicator when
the input receives keyboard focus, ensuring keyboard users can see which form
field is active.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: c815debd-af17-43c8-9ac1-bb56526e5cf0
📒 Files selected for processing (7)
ui/src/api/types.tsui/src/components/layout/InstanceAdminLayout.tsxui/src/pages/instance-admin/InstanceAdminAdminsPage.tsxui/src/pages/instance-admin/index.tsui/src/routes/index.tsxui/src/services/index.tsui/src/services/instanceService.ts
✅ Files skipped from review due to trivial changes (1)
- ui/src/pages/instance-admin/index.ts
… api vulnerabilities
…isible input focus
nazarli-shabnam
added a commit
that referenced
this pull request
Jun 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request updates both backend and frontend dependencies to address security, compatibility, and stability. The backend (
api) receives minor Go version and dependency upgrades, while the frontend (ui) updates several npm packages, including important libraries likeaxiosandvite. These changes help ensure the project stays current with upstream improvements and security patches.Backend (Go) dependency and environment updates:
api/go.modandapi/Dockerfilefrom 1.25.5/1.25-alpine to 1.25.9/1.25.9-alpine, ensuring the latest minor release is used. [1] [2]github.com/jackc/pgx/v5(v5.6.0 → v5.9.2),github.com/quic-go/qpack(v0.5.1 → v0.6.0), andgithub.com/quic-go/quic-go(v0.54.0 → v0.57.0). [1] [2]Frontend (npm) dependency updates:
axiosfrom^1.13.5to^1.15.2in bothui/package.jsonandui/package-lock.json, including its dependencyproxy-from-envandfollow-redirects, to address potential vulnerabilities and bugs. [1] [2] [3] [4] [5]vitefrom^7.3.1to^7.3.2for the build system, which may include bug fixes and performance improvements. [1] [2] [3]Other npm dependency bumps:
postcss(8.5.6 → 8.5.12) andbrace-expansion(multiple minor version bumps), which are indirect dependencies, to pull in upstream fixes and improvements. [1] [2] [3]Summary by CodeRabbit