github-mirror/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-07-27 19:15:01 +02:00
Code Issues Actions 14 Packages Projects Releases Wiki Activity Graph

build: Upgrade dependencies to resolve security advisories (#34025)

Browse Source 
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Declan Carroll 2026-07-14 15:00:15 +01:00 committed by GitHub
parent 59a1812d99
commit 33723ea285
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 553 additions and 464 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
package.json
View File

@ -119,7 +119,7 @@
"prebuild-install": "7.1.3",
"pug": "^3.0.3",
"semver": "catalog:",
"tar-fs": "2.1.4",
"tar-fs": "2.1.5",
"tslib": "^2.6.2",
"tsconfig-paths": "^4.2.0",
"vue-tsc": "catalog:frontend",
@ -173,16 +173,20 @@
"postcss@<=8.5.9": "8.5.10",
"@anthropic-ai/sdk@<=0.91.1": "0.91.1",
"uuid@<=13.0.1": "13.0.1",
"fast-uri": "3.1.2",
"fast-uri": "3.1.3",
"cjs-module-lexer@<2.2.0": "2.2.0",
"protobufjs": "7.6.3",
"ip-address@10": "10.1.1",
"brace-expansion@5": "5.0.6",
"brace-expansion@5": "5.0.7",
"@tootallnate/once@2": "2.0.1",
"@opentelemetry/exporter-prometheus@<=0.217.0": "0.217.0",
"@opentelemetry/sdk-node@<=0.217.0": "0.217.0",
"langsmith": "0.6.0",
"hono": "4.12.25",
"hono": "4.12.27",
"@tiptap/core": "catalog:",
"pg": "catalog:",
"file-type": "catalog:",
"linkify-it@<=5.0.1": "5.0.1",
"node-rsa": "2.0.0",
"@turbo/darwin-64@<=2.9.18": "2.9.18",
"@turbo/linux-64@<=2.9.18": "2.9.18",

9
packages/frontend/@n8n/design-system/src/__tests__/setup.ts
View File

@ -41,6 +41,15 @@ beforeAll(() => {
},
});
}
// jsdom lacks elementFromPoint; ProseMirror's posAtCoords calls it during
// editor mount (tiptap placeholder viewport tracking). null is a valid result.
const documentProto = Document.prototype as Document & {
elementFromPoint?: (x: number, y: number) => Element | null;
};
if (!documentProto.elementFromPoint) {
documentProto.elementFromPoint = () => null;
}
});
// Preserve originals

1
packages/testing/code-health/package.json
View File

@ -38,6 +38,7 @@
},
"devDependencies": {
"@vitest/coverage-v8": "catalog:",
"fast-check": "catalog:",
"vitest": "catalog:"
}
}

72
packages/testing/code-health/src/rules/stale-overrides.rule.test.ts
View File

@ -1,3 +1,4 @@
import fc from 'fast-check';
import * as fs from 'node:fs';
import * as os from 'node:os';
import * as path from 'node:path';
@ -290,6 +291,77 @@ describe('StaleOverridesRule', () => {
expect(violations).toHaveLength(0);
});
it('flags a versioned-selector override that duplicates a named catalog entry', () => {
// Regression: a dependency autofix pinned `undici@<=6.27.0` to a concrete
// version that the undici-v6 catalog already governs. The version selector
// on the key must not hide the duplication.
writeWorkspace(
tmpDir,
'packages:\n - packages/*\ncatalogs:\n undici-v6:\n undici: ^6.27.0\n',
);
writeRootPackageJson(tmpDir, { overrides: { 'undici@<=6.27.0': '6.27.0' } });
writeLock(tmpDir, { packages: ['undici@6.27.0'] });
const violations = rule.analyze(context());
const dup = violations.find((v) => v.message.includes('duplicates a catalog entry'));
expect(dup).toBeDefined();
expect(dup?.message).toContain('undici');
expect(dup?.message).toContain('"catalog:undici-v6"');
});
it('flags a scoped versioned-selector override that duplicates a default catalog entry', () => {
// Regression: a dependency autofix pinned `@tiptap/core@<=3.27.0` to a
// concrete version while the default catalog already pins @tiptap/core.
writeWorkspace(tmpDir, "packages:\n - packages/*\ncatalog:\n '@tiptap/core': 3.22.5\n");
writeRootPackageJson(tmpDir, { overrides: { '@tiptap/core@<=3.27.0': '3.27.0' } });
writeLock(tmpDir, { packages: ['@tiptap/core@3.27.0'] });
const violations = rule.analyze(context());
const dup = violations.find((v) => v.message.includes('duplicates a catalog entry'));
expect(dup).toBeDefined();
expect(dup?.message).toContain('@tiptap/core');
expect(dup?.message).toContain('"catalog:"');
});
it('detects catalog duplication regardless of any version selector on the key', () => {
// Metamorphic invariant: appending a version selector to an override key
// (`pkg` -> `pkg@<=1.2.3`) must not change whether the override is
// recognised as duplicating a catalog entry — the selector is irrelevant
// to "does this package duplicate a catalog entry". This is the exact
// class of override that slipped through as a concrete-version pin.
const pkgArb = fc.constantFrom(
'undici',
'lodash',
'chokidar',
'@tiptap/core',
'@sentry/node',
'@scope/pkg',
);
// `>` is pnpm's reserved parent>child separator, so realistic version
// selectors on an override key use `<=` / `<` / `^` / `~` / exact forms.
const selectorArb = fc.constantFrom('<=6.27.0', '<7.0.0', '^3.0.0', '~2.1.0', '5', '6.0.0');
const hasCatalogDuplicate = (overrideKey: string, pkg: string): boolean => {
const workspace = `packages:\n - packages/*\ncatalog:\n '${pkg}': 1.0.0\n`;
writeWorkspace(tmpDir, workspace);
writeRootPackageJson(tmpDir, { overrides: { [overrideKey]: '1.0.0' } });
writeLock(tmpDir, { packages: [`${pkg}@1.0.0`] });
return rule.analyze(context()).some((v) => v.message.includes('duplicates a catalog entry'));
};
fc.assert(
fc.property(pkgArb, selectorArb, (pkg, selector) => {
const bare = hasCatalogDuplicate(pkg, pkg);
const withSelector = hasCatalogDuplicate(`${pkg}@${selector}`, pkg);
expect(bare).toBe(true);
expect(withSelector).toBe(bare);
}),
);
});
it('reports the line number of the override key in package.json', () => {
writeWorkspace(tmpDir, 'packages:\n - packages/*\ncatalog:\n lodash: 4.18.1\n');
writeRootPackageJson(tmpDir, { overrides: { lodash: '4.18.1' } });

885
pnpm-lock.yaml
View File

File diff suppressed because it is too large Load Diff

38
pnpm-workspace.yaml
View File

@ -70,20 +70,20 @@ catalog:
'@testcontainers/mysql': ^11.13.0
'@testcontainers/postgresql': ^11.13.0
'@testcontainers/redis': ^11.13.0
'@tiptap/core': 3.22.5
'@tiptap/pm': 3.22.5
'@tiptap/extension-link': 3.22.5
'@tiptap/extension-placeholder': 3.22.5
'@tiptap/extension-strike': 3.22.5
'@tiptap/extension-table': 3.22.5
'@tiptap/extension-table-cell': 3.22.5
'@tiptap/extension-table-header': 3.22.5
'@tiptap/extension-table-row': 3.22.5
'@tiptap/extension-task-item': 3.22.5
'@tiptap/extension-task-list': 3.22.5
'@tiptap/markdown': 3.22.5
'@tiptap/starter-kit': 3.22.5
'@tiptap/vue-3': 3.22.5
'@tiptap/core': 3.27.0
'@tiptap/pm': 3.27.0
'@tiptap/extension-link': 3.27.0
'@tiptap/extension-placeholder': 3.27.0
'@tiptap/extension-strike': 3.27.0
'@tiptap/extension-table': 3.27.0
'@tiptap/extension-table-cell': 3.27.0
'@tiptap/extension-table-header': 3.27.0
'@tiptap/extension-table-row': 3.27.0
'@tiptap/extension-task-item': 3.27.0
'@tiptap/extension-task-list': 3.27.0
'@tiptap/markdown': 3.27.0
'@tiptap/starter-kit': 3.27.0
'@tiptap/vue-3': 3.27.0
'@types/basic-auth': ^1.1.3
'@types/estree': ^1.0.8
'@types/express': ^5.0.1
@ -126,7 +126,7 @@ catalog:
cross-env: ^7.0.3
csv-parse: 6.2.1
dotenv: 17.2.3
electron: ^41.7.2
electron: 41.9.1
esbuild: ^0.28.1
eslint: 9.29.0
eslint-plugin-oxlint: ^1.61.0
@ -137,7 +137,7 @@ catalog:
fast-json-patch: ^3.1.1
fastest-levenshtein: 1.0.16
fflate: 0.8.3
file-type: 21.3.2
file-type: 21.3.3
flatted: 3.4.2
form-data: 4.0.6
get-tsconfig: ^4.13.0
@ -174,7 +174,7 @@ catalog:
oxlint-tsgolint: ^0.21.1
pdf-parse: 2.4.5
pdfjs-dist: 5.4.296
pg: 8.17.0
pg: 8.21.0
picocolors: 1.0.1
playwright-core: 1.60.0
posthog-node: 5.33.4
@ -191,7 +191,7 @@ catalog:
ssh2: 1.15.0
stream-json: 1.9.1
stylelint: ^16.23.0
tar: ^7.5.16
tar: 7.5.17
testcontainers: ^11.13.0
ts-morph: ^27.0.2
tsdown: ^0.16.5
@ -260,7 +260,7 @@ catalogs:
eslint-plugin-storybook: ^10.1.11
storybook: ^10.1.11
undici-v6:
undici: ^6.24.0
undici: ^6.27.0
undici-v7:
undici: ^7.28.0