Skip to content

chore: update dependencies to fix security issues

Description

The dependency security issues have been significantly improved, with all fixable vulnerabilities resolved. The remaining backend vulnerabilities have no available fixes.

Backend (Go) Dependencies:

  • Reduced from 16 to 1 vulnerabilities
  • Fixed critical vulnerabilities in:
    • github.com/golang-jwt/jwt/v4 (v4.5.0 → v4.5.2)
    • github.com/jackc/pgx/v4 (v4.18.1 → v4.18.2) - Fixed SQL injection vulnerabilities
    • github.com/jackc/pgproto3/v2 (v2.3.2 → v2.3.3) - Fixed SQL injection vulnerabilities
    • golang.org/x/crypto (v0.14.0 → v0.41.0) - Fixed SSH/cryptographic vulnerabilities
  • Remaining vulnerabilities are from Docker client (no fix available)

Frontend (JS/TS) Dependencies:

  • Fixed ALL vulnerabilities (24 → 0)
  • Applied automatic security overrides for vulnerable packages
  • Updated Cypress from v12.17.4 to v14.5.4 to fix test dependency vulnerabilities
  • All critical, high, and moderate vulnerabilities resolved

Related issue

Examples

Checklist

  • MR description has been reviewed
  • MR changes are functionally tested
  • MR does NOT have API/CLI changes OR there are API/CLI changes and they have been reviewed & DOCS ARE ADJUSTED (reference doc, etc)
  • MR does NOT have UI changes OR there are UI changes and they have been reviewed & UX IS REVIEWED

Merge request reports

Loading