Skip to content

fix: nosql injection vulnerabilities, bump deps - #591

Merged
petruki merged 1 commit into
masterfrom
staging
Oct 31, 2026
Merged

petruki merged 1 commit into
masterfrom
staging

Conversation

@petruki

@petruki petruki commented Oct 31, 2026

Copy link
Copy Markdown
Member

This pull request focuses on improving compatibility, reliability, and maintainability across the codebase by standardizing type handling (especially for MongoDB ObjectIds), updating dependencies, and modernizing CI workflows. The most important changes are grouped below:

CI/CD Workflow Updates

  • Updated all GitHub Actions workflows to use ubuntu-22.04 instead of ubuntu-latest for improved stability and consistency. [1] [2] [3] [4] [5] [6] [7] [8]
  • Upgraded MongoDB version used in CI from 8.0 to 9.0.4 to match the latest supported features. [1] [2] [3] [4]
  • Updated SonarCloud scan action to v8.4.0 for better code analysis and compatibility. [1] [2]

Dependency Upgrades

  • Upgraded multiple dependencies in package.json (e.g., axios, express, mongodb, mongoose, moment, pino, switcher-client, and various dev dependencies) to their latest minor/patch versions to address security, performance, and compatibility.

Type Consistency and Data Handling

  • Standardized MongoDB queries throughout the codebase by explicitly converting IDs and keys to strings before database operations, reducing type mismatch bugs and improving maintainability. This affects resolvers, services, metrics, and history modules. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17]

Middleware and Validation Improvements

  • Refactored content type validation in gitops.js to use a Set instead of an array for improved performance and clarity. [1] [2]

These changes collectively enhance the robustness of the codebase, ensure smoother CI/CD operations, and reduce the risk of runtime errors due to inconsistent data types.

@petruki petruki added this to the v1.4.1 milestone Oct 31, 2026
@petruki petruki self-assigned this Oct 31, 2026
@petruki petruki added security Vulnerability detected patch Updating dependencies dependencies Pull requests that update a dependency file labels Oct 31, 2026
@sonarqubecloud

Copy link
Copy Markdown

@petruki
petruki merged commit 028efee into master Oct 31, 2026
5 checks passed
@petruki
petruki deleted the staging branch October 31, 2026 23:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file patch Updating dependencies security Vulnerability detected

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant