From da0b86f72bede4cb50dddb38c68583243e7e8d66 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sat, 17 Oct 2026 23:53:00 +0000 Subject: [PATCH 1/2] =?UTF-8?q?=E2=9A=A1=20Bolt:=20Optimize=20securityScan?= =?UTF-8?q?ner=20lookups=20and=20allocations?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hoist `nonSecretSubstrings`, `unsafeFuncs`, and `dbKeywords` out of the scan functions so they aren't re-allocated on every call. Convert `nonSecretSubstrings` to a `Set` to improve the O(N) `.includes()` lookup performance inside the `.some()` array loop to O(1) `.has()`. Co-authored-by: giauphan <122676967+giauphan@users.noreply.github.com> --- .jules/bolt.md | 3 + src/services/scanner/securityScanner.ts | 114 +++++++++++++----------- 2 files changed, 63 insertions(+), 54 deletions(-) diff --git a/.jules/bolt.md b/.jules/bolt.md index 2aa1f706..47e614cb 100644 --- a/.jules/bolt.md +++ b/.jules/bolt.md @@ -7,3 +7,6 @@ ## 2026-09-23 - Independent Connection Pools for Fire-and-Forget **Learning:** When attempting to make database updates non-blocking (fire-and-forget) to fix "Write on Read" bottlenecks, reusing the main request's database connection is unsafe. The surrounding code will often close or return the connection to the pool while the async background task is still running, leading to race conditions and "Connection closed" errors. **Action:** When implementing fire-and-forget updates in services, explicitly acquire a new background connection (`initPool().then(pool => pool.getConnection())`), capture synchronous context (like `tenantId`) to prevent async state loss, and handle errors/cleanup in a standalone promise chain that ends with `.finally(() => bgConn.close())`. +## 2024-05-23 - Optimizing Lookup Arrays in Scanners +**Learning:** Arrays used inside hot loops (like exact string match arrays using `.includes()` in `securityScanner.ts`) can become performance bottlenecks as `.includes()` has O(N) complexity and `array.some(v => array.includes(v))` operates at O(N*M). Converting the array to a `Set` makes lookups O(1). Additionally, dynamically defining static arrays inside functions causes them to be reallocated on every single call. +**Action:** Always hoist static arrays and convert exact-match arrays to `Set`s when optimizing frequently-called scanner functions. diff --git a/src/services/scanner/securityScanner.ts b/src/services/scanner/securityScanner.ts index 78fcc6fb..058cbfe0 100644 --- a/src/services/scanner/securityScanner.ts +++ b/src/services/scanner/securityScanner.ts @@ -11,6 +11,63 @@ export interface SecurityFinding { project?: string; } +// Bolt Optimization: Hoist static arrays and sets to avoid reallocation inside the scan loop +const unsafeFuncs = [ + "eval", + "exec", + "system", + "child_process", + "spawn", + "shell_exec", +]; + +const dbKeywords = [ + "db", + "database", + "repository", + "model", + "oracle", + "postgres", + "mysql", + "sqlite", + "sql", + "connection", + "pool", + "transaction", +]; + +// Bolt Optimization: Use a Set for O(1) lookups instead of O(N) Array.includes() +const nonSecretSubstrings = new Set([ + "expired", + "count", + "length", + "type", + "url", + "path", + "status", + "valid", + "error", + "failed", + "success", + "check", + "verify", + "duration", + "limit", + "payload", + "header", + "name", + "id", + "store", + "storage", + "service", + "provider", + "client", +]); + +// Hoist regex patterns to prevent recreation on every extraction +const SPLIT_WITH_SLASH = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|[_./-]/; +const SPLIT_NO_SLASH = /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|[_.-]/; + export class SecurityScanner { /** * Scan an analyzed project for security vulnerabilities @@ -30,35 +87,9 @@ export class SecurityScanner { linkMap.get(link.target)!.add(link.source); }); - const unsafeFuncs = [ - "eval", - "exec", - "system", - "child_process", - "spawn", - "shell_exec", - ]; - const dbKeywords = [ - "db", - "database", - "repository", - "model", - "oracle", - "postgres", - "mysql", - "sqlite", - "sql", - "connection", - "pool", - "transaction", - ]; - // Helper to extract words from a camelCase, snake_case, or kebab-case string const extractWords = (text: string, includeSlash: boolean = false): string[] => { - const regex = includeSlash - ? /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|[_./-]/ - : /(?<=[a-z0-9])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])|[_.-]/; - return text.split(regex).map((p) => p.toLowerCase()); + return text.split(includeSlash ? SPLIT_WITH_SLASH : SPLIT_NO_SLASH).map((p) => p.toLowerCase()); }; // Helper to identify test, mock or diagnostic files @@ -80,35 +111,10 @@ export class SecurityScanner { // Helper to detect if a variable name represents a real security secret/token/password const isSecretVariable = (label: string): boolean => { const parts = extractWords(label); - const nonSecretSubstrings = [ - "expired", - "count", - "length", - "type", - "url", - "path", - "status", - "valid", - "error", - "failed", - "success", - "check", - "verify", - "duration", - "limit", - "payload", - "header", - "name", - "id", - "store", - "storage", - "service", - "provider", - "client", - ]; // If the label contains any non-secret metadata word, skip it to prevent false positives - if (parts.some((part) => nonSecretSubstrings.includes(part))) { + // Bolt Optimization: O(1) Set lookup + if (parts.some((part) => nonSecretSubstrings.has(part))) { return false; } From cf31869b22243fa26efe0e61702d7148af8834f8 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 18 Oct 2026 00:10:01 +0000 Subject: [PATCH 2/2] =?UTF-8?q?=E2=9A=A1=20Bolt:=20Optimize=20securityScan?= =?UTF-8?q?ner=20lookups=20and=20allocations?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hoist `nonSecretSubstrings`, `unsafeFuncs`, and `dbKeywords` out of the scan functions so they aren't re-allocated on every call. Convert `nonSecretSubstrings` to a `Set` to improve the O(N) `.includes()` lookup performance inside the `.some()` array loop to O(1) `.has()`. Co-authored-by: giauphan <122676967+giauphan@users.noreply.github.com> --- dashboard/package.json | 3 + package.json | 11 +++- pnpm-lock.yaml | 129 ++++++++++++++++++++--------------------- pnpm-workspace.yaml | 2 +- 4 files changed, 75 insertions(+), 70 deletions(-) diff --git a/dashboard/package.json b/dashboard/package.json index b0fc6e55..d7e41f7e 100644 --- a/dashboard/package.json +++ b/dashboard/package.json @@ -23,6 +23,9 @@ "tailwind-merge": "^2.3.0", "three": "^0.185.1" }, + "overrides": { + "@grpc/grpc-js": "1.14.5" + }, "devDependencies": { "@testing-library/dom": "^10.4.1", "@testing-library/jest-dom": "^7.0.1", diff --git a/package.json b/package.json index 19df3201..f0c11341 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,12 @@ }, "overrides": { "uuid": "11.1.1", - "fast-uri": ">=3.1.6" + "fast-uri": ">=3.1.6", + "@grpc/grpc-js": "1.14.5", + "brace-expansion": "2.1.6", + "proxy-addr": "2.0.8", + "compression": "1.8.2", + "@modelcontextprotocol/sdk": "1.31.0" }, "devDependencies": { "@types/better-sqlite3": "^7.6.11", @@ -65,11 +70,11 @@ "typescript": "^7.0.2" }, "dependencies": { - "@modelcontextprotocol/sdk": "^1.0.1", + "@modelcontextprotocol/sdk": "1.31.0", "@types/compression": "^1.8.1", "@typescript-eslint/typescript-estree": "^8.0.0", "chokidar": "^5.0.0", - "compression": "^1.8.1", + "compression": "1.8.2", "cors": "2.8.5", "dotenv": "^17.4.2", "express": "^4.19.2", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index c7127007..db70b4db 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -11,7 +11,7 @@ overrides: ip-address: ^10.3.1 protobufjs: ^7.6.5 form-data: ^2.5.6 - '@grpc/grpc-js': ^1.14.4 + '@grpc/grpc-js': 1.14.5 uuid: 11.1.1 qs: ^6.16.0 '@babel/core': ^7.29.6 @@ -24,8 +24,8 @@ importers: .: dependencies: '@modelcontextprotocol/sdk': - specifier: ^1.0.1 - version: 1.30.0(zod@4.6.2) + specifier: 1.31.0 + version: 1.31.0(zod@4.6.2) '@types/compression': specifier: ^1.8.1 version: 1.8.1 @@ -36,8 +36,8 @@ importers: specifier: ^5.0.0 version: 5.0.0 compression: - specifier: ^1.8.1 - version: 1.8.1 + specifier: 1.8.2 + version: 1.8.2 cors: specifier: 2.8.5 version: 2.8.5 @@ -693,8 +693,8 @@ packages: resolution: {integrity: sha512-iFDlOGBzmzTelslzcf0yTpoqloyfTUi448PxJXvjtbvGqtc2ftT8HUSl5+sKQPRz70y64ha5FqojDhABP103EA==} engines: {node: '>=22'} - '@grpc/grpc-js@1.14.4': - resolution: {integrity: sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==} + '@grpc/grpc-js@1.14.5': + resolution: {integrity: sha512-7VZM+SVdEcUUqSQeNI3zM8Qs/BhQKZndPo2h5VkYkAM8Iz0wJIa8mKV5ekQGqG8UUsnkQ0NMxIxwkIHYvj0qOw==} engines: {node: '>=12.10.0'} '@grpc/proto-loader@0.7.15': @@ -707,8 +707,8 @@ packages: engines: {node: '>=6'} hasBin: true - '@hono/node-server@2.1.1': - resolution: {integrity: sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==} + '@hono/node-server@2.1.5': + resolution: {integrity: sha512-MgP/I06GdvsilDspMk/qmRzpk8LOUStP6jFAbSRi40W09DhoyUn+Mj7eyKICPqeYKybOjVFLVIAQzvu1bfIa7Q==} engines: {node: '>=20'} peerDependencies: hono: ^4.13.5 @@ -730,8 +730,8 @@ packages: '@js-sdsl/ordered-map@4.4.2': resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==} - '@modelcontextprotocol/sdk@1.30.0': - resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==} + '@modelcontextprotocol/sdk@1.31.0': + resolution: {integrity: sha512-UvTMgnNlnIBO/22ob2RcVGDlcvOslQs8T59+FTGdA0L27a39fdGF/EDETNtDVK4DZGpwomlsYpRdA8UXcVL/pw==} engines: {node: '>=18'} peerDependencies: '@cfworker/json-schema': ^4.1.1 @@ -1290,8 +1290,8 @@ packages: resolution: {integrity: sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==} engines: {node: '>= 0.8', npm: 1.2.8000 || >= 1.4.16} - brace-expansion@2.1.4: - resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} + brace-expansion@2.1.6: + resolution: {integrity: sha512-pi/WFpBvCBmB/NsURt7hW5sDvuOqvJaDMDai7CrlT9xoehzWRzo/dhQRKqOhpPvlnicVaTzHCbzGnnTgpvMTFw==} buffer-equal-constant-time@1.0.1: resolution: {integrity: sha512-zRpUiDwd/xk6ADqPMATG8vc9VPrkck7T07OIx0gnjmJAnHnTVXNQG3vfvWNuiZIkwu9KrKdA1iJKfsfTVxE6NA==} @@ -1345,16 +1345,16 @@ packages: resolution: {integrity: sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==} engines: {node: '>= 0.6'} - compression@1.8.1: - resolution: {integrity: sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==} + compression@1.8.2: + resolution: {integrity: sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==} engines: {node: '>= 0.8.0'} content-disposition@0.5.4: resolution: {integrity: sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==} engines: {node: '>= 0.6'} - content-disposition@1.1.0: - resolution: {integrity: sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==} + content-disposition@2.0.1: + resolution: {integrity: sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==} engines: {node: '>=18'} content-type@1.0.5: @@ -1640,8 +1640,8 @@ packages: resolution: {integrity: sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==} engines: {node: '>= 0.10.0'} - express@5.2.1: - resolution: {integrity: sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==} + express@5.3.0: + resolution: {integrity: sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==} engines: {node: '>= 18'} extend@3.0.2: @@ -1650,8 +1650,8 @@ packages: fast-deep-equal@3.1.3: resolution: {integrity: sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==} - fast-uri@3.1.7: - resolution: {integrity: sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==} + fast-uri@3.1.8: + resolution: {integrity: sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==} fast-xml-builder@1.3.1: resolution: {integrity: sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==} @@ -1871,8 +1871,8 @@ packages: resolution: {integrity: sha512-Qgpiaws3Sm30Av8Eah6sjMCZZwjlBu+E68rhpCWBshY1lb09HtLwj5GviX0OyQIn+ulUS0iX0AxN5n3tLZzz1w==} engines: {node: '>=18.0.0'} - hono@4.13.7: - resolution: {integrity: sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==} + hono@4.13.13: + resolution: {integrity: sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==} engines: {node: '>=16.9.0'} html-encoding-sniffer@6.0.0: @@ -2254,9 +2254,9 @@ packages: resolution: {integrity: sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==} engines: {node: '>= 0.6'} - negotiator@1.0.0: - resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==} - engines: {node: '>= 0.6'} + negotiator@1.1.0: + resolution: {integrity: sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==} + engines: {node: '>=18'} ngraph.events@1.4.0: resolution: {integrity: sha512-NeDGI4DSyjBNBRtA86222JoYietsmCXbs8CEB0dZ51Xeh4lhVl1y3wpWLumczvnha8sFQIW4E0vvVWwgmX2mGw==} @@ -2478,8 +2478,8 @@ packages: resolution: {integrity: sha512-dYDWdjSl5RNb7SgPxGQcRU+GtvP7s2fpkrY0r432PcOIaZ0/rBcxEZnQN67iJhFuQiVw754JDoPruPCNdGsbjg==} engines: {node: '>=12.0.0'} - proxy-addr@2.0.7: - resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==} + proxy-addr@2.0.8: + resolution: {integrity: sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==} engines: {node: '>= 0.10'} pump@3.0.4: @@ -2500,10 +2500,6 @@ packages: resolution: {integrity: sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==} engines: {node: '>= 0.6'} - range-parser@1.3.0: - resolution: {integrity: sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==} - engines: {node: '>= 0.6'} - raw-body@2.5.3: resolution: {integrity: sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==} engines: {node: '>= 0.8'} @@ -3385,7 +3381,7 @@ snapshots: '@firebase/logger': 0.5.2 '@firebase/util': 1.15.3 '@firebase/webchannel-wrapper': 1.0.7 - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@grpc/proto-loader': 0.7.15 re2js: 2.8.6 tslib: 2.8.1 @@ -3587,7 +3583,7 @@ snapshots: - supports-color optional: true - '@grpc/grpc-js@1.14.4': + '@grpc/grpc-js@1.14.5': dependencies: '@grpc/proto-loader': 0.8.1 '@js-sdsl/ordered-map': 4.4.2 @@ -3606,9 +3602,9 @@ snapshots: protobufjs: 7.6.6 yargs: 17.7.3 - '@hono/node-server@2.1.1(hono@4.13.7)': + '@hono/node-server@2.1.5(hono@4.13.13)': dependencies: - hono: 4.13.7 + hono: 4.13.13 '@isaacs/cliui@8.0.2': dependencies: @@ -3630,9 +3626,9 @@ snapshots: '@js-sdsl/ordered-map@4.4.2': {} - '@modelcontextprotocol/sdk@1.30.0(zod@4.6.2)': + '@modelcontextprotocol/sdk@1.31.0(zod@4.6.2)': dependencies: - '@hono/node-server': 2.1.1(hono@4.13.7) + '@hono/node-server': 2.1.5(hono@4.13.13) ajv: 8.20.0 ajv-formats: 3.0.1(ajv@8.20.0) content-type: 1.0.5 @@ -3640,9 +3636,9 @@ snapshots: cross-spawn: 7.0.6 eventsource: 3.0.7 eventsource-parser: 3.1.1 - express: 5.2.1 - express-rate-limit: 8.7.0(express@5.2.1) - hono: 4.13.7 + express: 5.3.0 + express-rate-limit: 8.7.0(express@5.3.0) + hono: 4.13.13 jose: 6.2.12 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -4025,7 +4021,7 @@ snapshots: accepts@2.0.0: dependencies: mime-types: 3.0.2 - negotiator: 1.0.0 + negotiator: 1.1.0 accessor-fn@1.5.3: {} @@ -4038,7 +4034,7 @@ snapshots: ajv@8.20.0: dependencies: fast-deep-equal: 3.1.3 - fast-uri: 3.1.7 + fast-uri: 3.1.8 json-schema-traverse: 1.0.0 require-from-string: 2.0.2 @@ -4116,7 +4112,7 @@ snapshots: transitivePeerDependencies: - supports-color - brace-expansion@2.1.4: + brace-expansion@2.1.6: dependencies: balanced-match: 1.0.2 @@ -4167,13 +4163,14 @@ snapshots: compressible@2.0.18: dependencies: - mime-db: 1.54.0 + mime-db: 1.52.0 - compression@1.8.1: + compression@1.8.2: dependencies: bytes: 3.1.2 compressible: 2.0.18 debug: 2.6.9 + destroy: 1.2.0 negotiator: 0.6.4 on-headers: 1.1.0 safe-buffer: 5.2.1 @@ -4185,7 +4182,7 @@ snapshots: dependencies: safe-buffer: 5.2.1 - content-disposition@1.1.0: {} + content-disposition@2.0.1: {} content-type@1.0.5: {} @@ -4445,10 +4442,10 @@ snapshots: transitivePeerDependencies: - supports-color - express-rate-limit@8.7.0(express@5.2.1): + express-rate-limit@8.7.0(express@5.3.0): dependencies: debug: 4.4.3 - express: 5.2.1 + express: 5.3.0 ip-address: 10.7.0 transitivePeerDependencies: - supports-color @@ -4475,7 +4472,7 @@ snapshots: on-finished: 2.4.1 parseurl: 1.3.3 path-to-regexp: 0.1.13 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.16.0 range-parser: 1.2.1 safe-buffer: 5.2.1 @@ -4489,12 +4486,12 @@ snapshots: transitivePeerDependencies: - supports-color - express@5.2.1: + express@5.3.0: dependencies: accepts: 2.0.0 body-parser: 1.20.6 - content-disposition: 1.1.0 - content-type: 1.0.5 + content-disposition: 2.0.1 + content-type: 2.1.0 cookie: 0.7.2 cookie-signature: 1.2.2 debug: 4.4.3 @@ -4510,9 +4507,9 @@ snapshots: on-finished: 2.4.1 once: 1.4.0 parseurl: 1.3.3 - proxy-addr: 2.0.7 + proxy-addr: 2.0.8 qs: 6.16.0 - range-parser: 1.3.0 + range-parser: 1.2.1 router: 2.2.0 send: 1.2.1 serve-static: 2.2.1 @@ -4526,7 +4523,7 @@ snapshots: fast-deep-equal@3.1.3: {} - fast-uri@3.1.7: {} + fast-uri@3.1.8: {} fast-xml-builder@1.3.1: dependencies: @@ -4848,7 +4845,7 @@ snapshots: google-gax@5.0.8: dependencies: - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@grpc/proto-loader': 0.8.1 duplexify: 4.1.3 google-auth-library: 10.5.0 @@ -4865,7 +4862,7 @@ snapshots: google-gax@6.3.0: dependencies: - '@grpc/grpc-js': 1.14.4 + '@grpc/grpc-js': 1.14.5 '@grpc/proto-loader': 0.8.1 '@opentelemetry/api': 1.9.1 duplexify: 4.1.3 @@ -4916,7 +4913,7 @@ snapshots: helmet@8.3.0: {} - hono@4.13.7: {} + hono@4.13.13: {} html-encoding-sniffer@6.0.0: dependencies: @@ -5212,11 +5209,11 @@ snapshots: minimatch@10.2.6: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.6 minimatch@9.0.9: dependencies: - brace-expansion: 2.1.4 + brace-expansion: 2.1.6 minimist@1.2.8: {} @@ -5244,7 +5241,9 @@ snapshots: negotiator@0.6.4: {} - negotiator@1.0.0: {} + negotiator@1.1.0: + dependencies: + content-type: 2.1.0 ngraph.events@1.4.0: {} @@ -5463,7 +5462,7 @@ snapshots: '@types/node': 26.6.2 long: 5.3.2 - proxy-addr@2.0.7: + proxy-addr@2.0.8: dependencies: forwarded: 0.2.0 ipaddr.js: 1.9.1 @@ -5484,8 +5483,6 @@ snapshots: range-parser@1.2.1: {} - range-parser@1.3.0: {} - raw-body@2.5.3: dependencies: bytes: 3.1.2 @@ -5635,7 +5632,7 @@ snapshots: mime-types: 3.0.2 ms: 2.1.3 on-finished: 2.4.1 - range-parser: 1.3.0 + range-parser: 1.2.1 statuses: 2.0.2 transitivePeerDependencies: - supports-color diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 8765fc68..a1d386a4 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -13,7 +13,7 @@ overrides: ip-address: "^10.3.1" protobufjs: "^7.6.5" form-data: "^2.5.6" - "@grpc/grpc-js": "^1.14.4" + "@grpc/grpc-js": "1.14.5" uuid: "11.1.1" qs: "^6.16.0" "@babel/core": "^7.29.6"