Repository navigation
Dependabots alerts fixes - #5517
Conversation
2e22f22 to
43d94d3
Compare
43d94d3 to
5e0b021
Compare
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…parsing Dokploy is moving to toml 4.2.0 (Dokploy/dokploy#5517) and fetches template.toml from this repo at runtime, so these templates would fail to parse there. - signoz, supabase: escape invalid backslash sequences (\{ \$ \( \s ...) as \\ so the parsed value keeps the literal backslash exactly as toml 3 produced it - timescaledb, valkey: drop `mounts = []` that was redefined by [[config.mounts]] Parsed output is deep-equal to before under toml 3 for all 532 templates.
Dependencies: - app: react-router-dom ^7.18.0, vite ^6.4.3, yaml 2.8.3 - app (transitive, lockfile only): postcss 8.5.28, nanoid 3.3.19, picomatch 2.3.2/4.0.7, browserslist 4.29.2, rollup 4.63.5, @babel/core 7.29.7, @babel/runtime 7.29.7 - build-scripts: toml 4.2.0 (matches Dokploy/dokploy#5517), yaml 2.8.3 Templates rejected by toml 4's strict parsing (Dokploy fetches template.toml from this repo at runtime, so they would fail there once #5517 ships): - signoz, supabase: write invalid escape sequences (\{ \$ \( \s ...) as \\ so the parsed value keeps the literal backslash exactly as toml 3 produced it - timescaledb, valkey: drop `mounts = []` redefined by [[config.mounts]] Parsed output is deep-equal to before under toml 3 for all 532 templates.
|
Thanks for this, @narcisonunez! It already clears most of the Dependabot alerts. I ran the npm advisory audit against this branch's lockfile (head
Suggested changes:
By my count that leaves about 10 advisories (3 high, 7 moderate) and no critical ones. The 3 high ones can't be fixed with a version bump yet. @Siumauricio, since you're the requested reviewer: is there a rough timeline for merging this? Days, weeks, or longer? It's been open since Sep 23 and fixes ~190 advisories, so it would help to know what to expect. Happy to help test the branch if that's useful. |
|
You're doing a great job, and it's best not to rush into decisions—it'll quickly weed you out. But I hope someone knowledgeable in programming will step aside to develop and deploy code more quickly and improve this product, rather than dealing with stupid bureaucracy. Otherwise, it will be a month or more before you accept this PR. |
|
@agentHits Thank you for your support. We are focusing on community and open source features. We don't like to rush pushing changes without a proper validation from the internal team. We value all the effort people put into PRs and issues but we need to make sure we keep the product stable as much as we can. That been said, we now have an internal policy to fix this dependabots alerts asap. At least the critical ones. |
|
@narcisonunez @Siumauricio What kind of stability is this? If your project is riddled with bugs and security holes? Step 1 - First, update the libraries to the latest versions and add support for all of these . You haven't done anything meaningful to fix these three points since summer—your boss just gave up and that's it. You'd be better off focusing on stability and improving the product, fixing bugs, updating libraries, and rewriting the junk code to something more reliable and modern long ago. If you tell someone on the sidelines that a project collects $6,000 in donations, but is crawling along at a snail's pace—that's ridiculous, thanks to AI assistance—you could have done a lot. Take my example - this is your fork https://github.com/agentHits/dokploy , and I'm making it my own. The fork has everything I described. If I were coding it myself, I would have done it even better and more. But at least I've eliminated security and the tricks of insecure libraries. Anyway, it's worthwhile for me to split from you. I'm implementing what I need and monitoring security using AI, but I have more functionality and convenience than you. |
|
@narcisonunez @Siumauricio It might even be more profitable for you to fork my project, if you agree. I can fully upgrade to your version—I'm 28 commits behind, and my fork is easier to fix because I've contributed a lot to the code, maybe 150,000 lines of code, maybe more. But that's only if you want it. Until you do, your project will simply slow down. It's more profitable for me to update my fork than yours, because it's bureaucratic and a waste of time. I'm surprised the owner can't hire staff who could run faster project updates and provide good support to resolve all issues in a timely manner—but frankly, I don't believe you'll improve, so I'll continue working on the fork https://github.com/agentHits/dokploy |
What is this PR about?
This PR will fix almost all dependabots alerts. The remaining ones will be addressed later when we implement some new features from better-auth. The new version changes couple things
Checklist
Before submitting this PR, please make sure that:
canarybranch.Issues related (if applicable)
Screenshots (if applicable)
The PR appears generally safe to merge, but the unscoped deepmerge-ts major-version override should be corrected or validated against Prisma first.
Summary
This PR updates direct and transitive JavaScript and Go dependencies to remediate Dependabot alerts, refreshes the lockfiles, and migrates the renamed Faker username API.
Reviews (1) · Last reviewed commit: "fix(deps): resolve open Dependabot alert..."