mirror of
https://github.com/Unleash/unleash.git
synced 2026-09-10 22:25:45 +00:00
renovate[bot]
7f4cca79cb
This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---|---|---| | [node](https://nodejs.org) ([source](https://redirect.github.com/nodejs/node)) | | minor | `22.22` → `22.23` |  |  | | [node](https://redirect.github.com/nodejs/node) | final | minor | `22.22-alpine3.23` → `22.23-alpine3.23` |  |  | | [node](https://redirect.github.com/nodejs/node) | stage | minor | `22.22-alpine3.23` → `22.23-alpine3.23` |  |  | | [@types/node](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node) ([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)) | devDependencies | minor | [`22.19.21` → `22.20.0`](https://renovatebot.com/diffs/npm/@types%2fnode/22.19.21/22.20.0) |  |  | --- > [!WARNING] > Some dependencies could not be looked up. Check the [Dependency Dashboard](../issues/959) for more information. --- ### Release Notes <details> <summary>nodejs/node (node)</summary> ### [`v22.23.1`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.1): 2026-06-23, Version 22.23.1 'Jod' (LTS), @​RafaelGSS [Compare Source](https://redirect.github.com/nodejs/node/compare/v22.23.0...v22.23.1) This release includes a fix for an unexpected behavior introduced by the recent security release (22.23.0). ##### Commits - \[[`41d2ee13be`](https://redirect.github.com/nodejs/node/commit/41d2ee13be)] - **build**: switch coverage-windows to `windows-2022` (Richard Lau) [#​63940](https://redirect.github.com/nodejs/node/pull/63940) - \[[`eaa292549e`](https://redirect.github.com/nodejs/node/commit/eaa292549e)] - **http**: avoid stream listeners on idle agent sockets (Matteo Collina) [#​64004](https://redirect.github.com/nodejs/node/pull/64004) ### [`v22.23.0`](https://redirect.github.com/nodejs/node/releases/tag/v22.23.0): 2026-06-18, Version 22.23.0 'Jod' (LTS), @​aduh95 [Compare Source](https://redirect.github.com/nodejs/node/compare/v22.22.3...v22.23.0) This is a security release. ##### Notable Changes - (CVE-2026-48618) tls: normalize hostname for server identity checks (Matteo Collina) – High - (CVE-2026-48933) crypto: guard WebCrypto cipher output length (Filip Skokan) – High - (CVE-2026-48937) deps: fix integration issues with the latest nghttp2 – Medium - (CVE-2026-48930) dns,net: reject hostnames with embedded NUL bytes (Matteo Collina) – Medium - (CVE-2026-48619) http2: cap originSet size to prevent unbounded memory growth (Matteo Collina) – Medium - (CVE-2026-48615) lib,test: redact proxy credentials in tunnel errors (Matteo Collina) – Medium - (CVE-2026-48934) tls: bind reusable sessions to authenticated host (Matteo Collina) – Medium - (CVE-2026-48928) tls: fix case-sensitive SNI context matching (Matteo Collina) – Medium - (CVE-2026-48617) permission: handle process.chdir on writereport (RafaelGSS) – Low - (CVE-2026-48931) http: fix response queue poisoning in http.Agent (Matteo Collina) – Low - (CVE-2026-48935) permission: disable FileHandle utimes with permission model (RafaelGSS) – Low ##### Commits - \[[`38b4c5ed51`](https://redirect.github.com/nodejs/node/commit/38b4c5ed51)] - **(CVE-2026-48933)** **crypto**: guard WebCrypto cipher output length (Filip Skokan) [nodejs-private/node-private#878](https://redirect.github.com/nodejs-private/node-private/pull/878) - \[[`ad8a10c1bb`](https://redirect.github.com/nodejs/node/commit/ad8a10c1bb)] - **deps**: update llhttp to 9.4.2 (Antoine du Hamel) [nodejs-private/node-private#890](https://redirect.github.com/nodejs-private/node-private/pull/890) - \[[`ca825a87cc`](https://redirect.github.com/nodejs/node/commit/ca825a87cc)] - **deps**: update undici to 6.27.0 (aduh95) [#​63711](https://redirect.github.com/nodejs/node/pull/63711) - \[[`a1a5bb9683`](https://redirect.github.com/nodejs/node/commit/a1a5bb9683)] - **(CVE-2026-48937)** **deps**: fix integration issues with the latest nghttp2 (Tim Perry) [#​62891](https://redirect.github.com/nodejs/node/pull/62891) - \[[`0f48583512`](https://redirect.github.com/nodejs/node/commit/0f48583512)] - **(SEMVER-MAJOR)** **deps**: update nghttp2 to 1.69.0 (Node.js GitHub Bot) [#​62891](https://redirect.github.com/nodejs/node/pull/62891) - \[[`38c869fc05`](https://redirect.github.com/nodejs/node/commit/38c869fc05)] - **deps**: update nghttp2 to 1.68.0 (nodejs-github-bot) [#​61136](https://redirect.github.com/nodejs/node/pull/61136) - \[[`290667c84f`](https://redirect.github.com/nodejs/node/commit/290667c84f)] - **deps**: update nghttp2 to 1.67.1 (nodejs-github-bot) [#​59790](https://redirect.github.com/nodejs/node/pull/59790) - \[[`c9f3da76aa`](https://redirect.github.com/nodejs/node/commit/c9f3da76aa)] - **deps**: update nghttp2 to 1.66.0 (Node.js GitHub Bot) [#​58786](https://redirect.github.com/nodejs/node/pull/58786) - \[[`60890be563`](https://redirect.github.com/nodejs/node/commit/60890be563)] - **deps**: update nghttp2 to 1.65.0 (Node.js GitHub Bot) [#​57269](https://redirect.github.com/nodejs/node/pull/57269) - \[[`5024c7d5d8`](https://redirect.github.com/nodejs/node/commit/5024c7d5d8)] - **deps**: update archs files for openssl-3.5.7 (Node.js GitHub Bot) [#​63820](https://redirect.github.com/nodejs/node/pull/63820) - \[[`7f4eb5af2e`](https://redirect.github.com/nodejs/node/commit/7f4eb5af2e)] - **deps**: upgrade openssl sources to openssl-3.5.7 (Node.js GitHub Bot) [#​63820](https://redirect.github.com/nodejs/node/pull/63820) - \[[`ebb4ec78a8`](https://redirect.github.com/nodejs/node/commit/ebb4ec78a8)] - **deps**: fix aix implicit declaration in OpenSSL (Abdirahim Musse) [#​62656](https://redirect.github.com/nodejs/node/pull/62656) - \[[`5763d40826`](https://redirect.github.com/nodejs/node/commit/5763d40826)] - **deps**: update llhttp to 9.4.1 (Node.js GitHub Bot) [#​63045](https://redirect.github.com/nodejs/node/pull/63045) - \[[`c551a51d0c`](https://redirect.github.com/nodejs/node/commit/c551a51d0c)] - **(CVE-2026-48930)** **dns,net**: reject hostnames with embedded NUL bytes (Matteo Collina) [nodejs-private/node-private#868](https://redirect.github.com/nodejs-private/node-private/pull/868) - \[[`0a22d40180`](https://redirect.github.com/nodejs/node/commit/0a22d40180)] - **(CVE-2026-48931)** **http**: fix response queue poisoning in http.Agent (Matteo Collina) [nodejs-private/node-private#846](https://redirect.github.com/nodejs-private/node-private/pull/846) - \[[`c79968e108`](https://redirect.github.com/nodejs/node/commit/c79968e108)] - **(CVE-2026-48619)** **http2**: cap originSet size to prevent unbounded memory growth (Matteo Collina) [nodejs-private/node-private#855](https://redirect.github.com/nodejs-private/node-private/pull/855) - \[[`0c37bff2ff`](https://redirect.github.com/nodejs/node/commit/0c37bff2ff)] - **http2**: fix DEP0194 message (KaKa) [#​58669](https://redirect.github.com/nodejs/node/pull/58669) - \[[`ea5dc6b529`](https://redirect.github.com/nodejs/node/commit/ea5dc6b529)] - **(SEMVER-MAJOR)** **http2**: remove support for priority signaling (Matteo Collina) [#​58293](https://redirect.github.com/nodejs/node/pull/58293) - \[[`9b6af26132`](https://redirect.github.com/nodejs/node/commit/9b6af26132)] - **(CVE-2026-48615)** **lib,test**: redact proxy credentials in tunnel errors (Matteo Collina) [nodejs-private/node-private#867](https://redirect.github.com/nodejs-private/node-private/pull/867) - \[[`28dcd38864`](https://redirect.github.com/nodejs/node/commit/28dcd38864)] - **(CVE-2026-48935)** **permission**: disable FileHandle utimes with permission model (RafaelGSS) [nodejs-private/node-private#873](https://redirect.github.com/nodejs-private/node-private/pull/873) - \[[`2f62693801`](https://redirect.github.com/nodejs/node/commit/2f62693801)] - **(CVE-2026-48617)** **permission**: handle process.chdir on writereport (RafaelGSS) [nodejs-private/node-private#870](https://redirect.github.com/nodejs-private/node-private/pull/870) - \[[`1662a3ea09`](https://redirect.github.com/nodejs/node/commit/1662a3ea09)] - **test**: add session reuse host verification regressions (Matteo Collina) [nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854) - \[[`718d5d0e2c`](https://redirect.github.com/nodejs/node/commit/718d5d0e2c)] - **test**: skip `test-fs-utimes-y2K38` on armv7 (Richard Lau) [#​63836](https://redirect.github.com/nodejs/node/pull/63836) - \[[`041185b61f`](https://redirect.github.com/nodejs/node/commit/041185b61f)] - **test**: skip test-cluster-dgram-reuse on AIX 7.3 (Stewart X Addison) [#​62238](https://redirect.github.com/nodejs/node/pull/62238) - \[[`fd890ba01d`](https://redirect.github.com/nodejs/node/commit/fd890ba01d)] - **(CVE-2026-48934)** **tls**: bind reusable sessions to authenticated host (Matteo Collina) [nodejs-private/node-private#854](https://redirect.github.com/nodejs-private/node-private/pull/854) - \[[`39d1d09684`](https://redirect.github.com/nodejs/node/commit/39d1d09684)] - **(CVE-2026-48928)** **tls**: fix case-sensitive SNI context matching (Matteo Collina) [nodejs-private/node-private#857](https://redirect.github.com/nodejs-private/node-private/pull/857) - \[[`2197a47144`](https://redirect.github.com/nodejs/node/commit/2197a47144)] - **(CVE-2026-48618)** **tls**: normalize hostname for server identity checks (Matteo Collina) [nodejs-private/node-private#869](https://redirect.github.com/nodejs-private/node-private/pull/869) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Madrid) - Branch creation - "after 7pm every weekday,before 5am every weekday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Unleash/unleash). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNDIuMiIsInVwZGF0ZWRJblZlciI6IjQzLjI0Mi4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
204 lines
7.1 KiB
JSON
204 lines
7.1 KiB
JSON
{
|
|
"name": "unleash-server",
|
|
"type": "module",
|
|
"description": "Unleash is an enterprise ready feature flag service. It provides different strategies for handling feature flags.",
|
|
"version": "8.0.2",
|
|
"keywords": [
|
|
"unleash",
|
|
"feature flag",
|
|
"flag",
|
|
"feature toggle",
|
|
"feature",
|
|
"toggle"
|
|
],
|
|
"files": [
|
|
"dist",
|
|
"frontend/build",
|
|
"frontend/build/*",
|
|
"frontend/build/**/*",
|
|
"frontend/index.js",
|
|
"frontend/package.json"
|
|
],
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/Unleash/unleash.git"
|
|
},
|
|
"bugs": {
|
|
"url": "https://github.com/unleash/unleash/issues"
|
|
},
|
|
"types": "./dist/lib/server-impl.d.ts",
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"license": "AGPL-3.0-or-later",
|
|
"exports": "./dist/lib/server-impl.js",
|
|
"scripts": {
|
|
"ci": "pnpm run lint:fix && pnpm run build:backend && pnpm run test --reporter=dot",
|
|
"start": "TZ=UTC node ./dist/server.js",
|
|
"copy-templates": "mkdir -p dist && cp -r src/mailtemplates dist/",
|
|
"copy-migrations-package": "mkdir -p dist/migrations && cp src/migrations/package.json dist/migrations/",
|
|
"build:backend": "tsc --pretty && pnpm run copy-migrations-package",
|
|
"build:frontend": "pnpm --dir ./frontend run build",
|
|
"build:frontend:if-needed": "./scripts/build-frontend-if-needed.sh",
|
|
"build": "pnpm run clean && pnpm run copy-templates && pnpm run build:frontend && pnpm run build:backend",
|
|
"dev:vite": "TZ=UTC NODE_ENV=development vite-node src/server-dev.ts",
|
|
"dev:backend": "pnpm run copy-migrations-package && TZ=UTC NODE_ENV=${NODE_ENV:-development} tsc-watch --onSuccess \"node dist/server-dev.js\"",
|
|
"dev:frontend": "wait-on tcp:4242 && pnpm --dir ./frontend run dev",
|
|
"dev:frontend:cloud": "UNLEASH_BASE_PATH=/demo/ pnpm run dev:frontend",
|
|
"dev": "concurrently \"pnpm run dev:backend\" \"pnpm run dev:frontend\"",
|
|
"profile:startup": "./scripts/profile-startup.sh",
|
|
"prepare:backend": "concurrently \"pnpm run copy-templates\" \"pnpm run build:backend\"",
|
|
"start:dev": "pnpm run clean && pnpm run dev:backend",
|
|
"db-migrate": "db-migrate --migrations-dir ./src/migrations",
|
|
"lint": "biome check . --error-on-warnings",
|
|
"lint:fix": "biome check . --write --error-on-warnings",
|
|
"lint:fix:unsafe": "biome check . --write --error-on-warnings --unsafe",
|
|
"local:package": "del-cli --force build && mkdir build && cp -r dist CHANGELOG.md LICENSE README.md package.json build",
|
|
"build:watch": "tsc -w",
|
|
"prepare": "husky && if [ ! -d ./dist ]; then pnpm run build; fi",
|
|
"test": "PORT=4243 vitest run",
|
|
"test:unit": "PORT=4243 vitest --exclude src/test/e2e",
|
|
"test:docker": "./scripts/docker-postgres.sh",
|
|
"test:report": "PORT=4243 vitest --reporter=junit",
|
|
"test:docker:cleanup": "docker rm -f unleash-postgres",
|
|
"test:watch": "vitest",
|
|
"test:coverage": "PORT=4243 vitest run --coverage --outputFile=\"coverage/report.json\"",
|
|
"test:updateSnapshot": "PORT=4243 vitest run -u",
|
|
"test:ui": "vitest --ui",
|
|
"test:trace": "NODE_OPTIONS=--trace-warnings pnpm run test --no-file-parallelism",
|
|
"seed:setup": "ts-node src/test/e2e/seed/segment.seed.ts",
|
|
"seed:serve": "UNLEASH_DATABASE_NAME=unleash_test UNLEASH_DATABASE_SCHEMA=seed pnpm run start:dev",
|
|
"clean": "del-cli --force dist",
|
|
"prepack": "./scripts/prepack.sh",
|
|
"schema:update": "node ./.husky/update-openapi-spec-list.js"
|
|
},
|
|
"dependencies": {
|
|
"@json2csv/plainjs": "^7.0.6",
|
|
"@slack/web-api": "^7.15.1",
|
|
"@wesleytodd/openapi": "^1.1.0",
|
|
"ajv": "^8.20.0",
|
|
"ajv-formats": "^3.0.1",
|
|
"async": "^3.2.6",
|
|
"bcryptjs": "^3.0.3",
|
|
"compression": "^1.8.1",
|
|
"connect-session-knex": "^5.0.0",
|
|
"cookie-parser": "^1.4.7",
|
|
"cookie-session": "^2.1.1",
|
|
"cors": "^2.8.6",
|
|
"date-fns": "^4.1.0",
|
|
"db-migrate": "0.11.14",
|
|
"db-migrate-pg": "1.5.2",
|
|
"db-migrate-shared": "1.2.0",
|
|
"deep-object-diff": "^1.1.9",
|
|
"deepmerge": "^4.3.1",
|
|
"errorhandler": "^1.5.2",
|
|
"express": "^4.22.1",
|
|
"express-rate-limit": "^8.4.1",
|
|
"express-session": "^1.19.0",
|
|
"fast-json-patch": "^3.1.1",
|
|
"hash-sum": "^2.0.0",
|
|
"helmet": "^8.1.0",
|
|
"http-errors": "^2.0.1",
|
|
"hyperloglog-lite": "^1.0.2",
|
|
"ip-address": "10.2.0",
|
|
"joi": "^18.1.2",
|
|
"js-sha256": "^0.11.1",
|
|
"js-yaml": "^4.1.1",
|
|
"json-diff": "^1.0.6",
|
|
"json-schema-to-ts": "3.1.1",
|
|
"knex": "^3.2.10",
|
|
"ky": "^1.14.3",
|
|
"lodash": "^4.18.1",
|
|
"lodash.get": "^4.4.2",
|
|
"lodash.groupby": "^4.6.0",
|
|
"lodash.isequal": "^4.5.0",
|
|
"lodash.sortby": "^4.7.0",
|
|
"log4js": "^6.9.1",
|
|
"memoizee": "^0.4.17",
|
|
"mime": "^4.1.0",
|
|
"murmurhash3js": "^3.0.1",
|
|
"mustache": "^4.2.0",
|
|
"nodemailer": "^9.0.1",
|
|
"normalize-url": "^9.0.0",
|
|
"openapi-types": "^12.1.3",
|
|
"owasp-password-strength-test": "^1.3.0",
|
|
"parse-database-url": "^0.3.0",
|
|
"pg": "^8.20.0",
|
|
"pg-connection-string": "^2.12.0",
|
|
"pkginfo": "^0.4.1",
|
|
"prom-client": "^15.1.3",
|
|
"re2js": "2.3.2",
|
|
"sanitize-filename": "^1.6.4",
|
|
"sanitize-html": "^2.17.5",
|
|
"semver": "7.7.4",
|
|
"serve-favicon": "^2.5.1",
|
|
"slug": "^11.0.1",
|
|
"stoppable": "^1.1.0",
|
|
"tldts": "7.0.30",
|
|
"ts-toolbelt": "^9.6.0",
|
|
"type-is": "^2.0.1",
|
|
"ulidx": "^2.4.1",
|
|
"unleash-client": "^6.11.1"
|
|
},
|
|
"devDependencies": {
|
|
"@apidevtools/swagger-parser": "12.1.0",
|
|
"@biomejs/biome": "2.4.16",
|
|
"@faker-js/faker": "^10.4.0",
|
|
"@fast-check/vitest": "^0.4.1",
|
|
"@types/cors": "2.8.19",
|
|
"@types/express": "4.17.25",
|
|
"@types/express-session": "1.19.0",
|
|
"@types/hash-sum": "^1.0.2",
|
|
"@types/http-errors": "2.0.5",
|
|
"@types/js-yaml": "4.0.9",
|
|
"@types/lodash": "4.17.24",
|
|
"@types/lodash.groupby": "4.6.9",
|
|
"@types/lodash.isequal": "^4.5.8",
|
|
"@types/memoizee": "0.4.12",
|
|
"@types/murmurhash3js": "^3.0.7",
|
|
"@types/mustache": "^4.2.6",
|
|
"@types/node": "22.20.0",
|
|
"@types/nodemailer": "^7.0.11",
|
|
"@types/owasp-password-strength-test": "1.3.2",
|
|
"@types/pg": "8.20.0",
|
|
"@types/sanitize-html": "^2.16.1",
|
|
"@types/semver": "7.7.1",
|
|
"@types/slug": "^5.0.9",
|
|
"@types/stoppable": "1.1.3",
|
|
"@types/supertest": "6.0.3",
|
|
"@types/type-is": "1.6.7",
|
|
"@vitest/coverage-v8": "4.1.9",
|
|
"@vitest/ui": "4.1.9",
|
|
"concurrently": "^10.0.0",
|
|
"del-cli": "7.0.0",
|
|
"fast-check": "4.8.0",
|
|
"fetch-mock": "^12.6.0",
|
|
"husky": "^9.1.7",
|
|
"lint-staged": "16.4.0",
|
|
"nock": "^14.0.14",
|
|
"openapi-enforcer": "1.23.0",
|
|
"proxyquire": "2.1.3",
|
|
"source-map-support": "0.5.21",
|
|
"superagent": "10.3.0",
|
|
"supertest": "7.2.2",
|
|
"ts-node": "10.9.2",
|
|
"tsc-watch": "7.2.0",
|
|
"typescript": "5.9.3",
|
|
"vite-node": "^6.0.0",
|
|
"vitest": "4.1.9",
|
|
"wait-on": "^9.0.5"
|
|
},
|
|
"lint-staged": {
|
|
"*.{js,ts}": [
|
|
"pnpm biome check --write --no-errors-on-unmatched"
|
|
],
|
|
"*.{jsx,tsx}": [
|
|
"pnpm biome check --write --no-errors-on-unmatched"
|
|
],
|
|
"*.json": [
|
|
"pnpm biome format --write --no-errors-on-unmatched"
|
|
]
|
|
},
|
|
"packageManager": "pnpm@11.8.0+sha512.c1f5e7c4cb241c8f174b743851d82f42b802324afc8b0f116b96adb15aa06664948dde36960a3ba1079ba5b4b29dd0140135b94b5b5f5263592249d68e555f26"
|
|
}
|