Bump postcss to 8.5.23 and react-router to 8.3.0 to clear their high-severity advisories. Leave nested brace-expansion issues for a follow-up that won't break older minimatch consumers.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Bump @n8n/node-cli to 0.37.1 (the `^0.24.1` range was trapping it at
0.24.x), which pulls an updated toolchain and clears the eslint@8,
glob@7, inflight, rimraf@3, @humanwhocodes/*, node-domexception and
uuid@10 deprecation warnings at the source.
Add a glob override (^13.0.6) so rimraf@6 no longer pulls the
deprecated glob@11, and trim the overrides list down to the three that
actually do work (uuid, js-yaml, glob); the rest were redundant or dead.
npm audit reports 0 vulnerabilities.
The upgraded @n8n/eslint-plugin-community-nodes rules flagged two
pre-existing issues in the Probo node, now fixed: handle
continueOnFail() in execute() and throw NodeOperationError instead of
raw Error.
The only remaining warning is @langchain/community, whose entire
package is deprecated upstream and is a hard dependency of
@n8n/ai-utilities.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
The compliance-portal app still carried the per-workspace ESLint
scaffold that the rest of the monorepo dropped when linting was
centralized into the root eslint.config.mjs. It defined its own
local config, lint script, and lint-only devDeps, and was not
covered by the root lint script, so it was never linted.
Remove the local eslint.config.mjs, the lint script, and the
eslint/@probo/eslint-config devDeps, then add the app to the root
appDirs so the shared ts, react, and relay rule sets apply to it.
Replace the explicit per-directory list in the root lint script
with a bare `eslint .`, which the root config was already designed
for via its globalIgnores. Ignore pkg/** so the vendored minified
JS under the Go tree is not linted.
Signed-off-by: Émile Ré <emile@probo.com>
Allow install scripts for the packages we actually need (esbuild for
Vite builds, fsevents for dev file watching, unrs-resolver for n8n
linting) and deny the rest (core-js, isolated-vm,
eslint-plugin-n8n-nodes-base) so npm 11's install-script warning is
covered.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Regenerate the stale package-lock and pin patched versions for the
Dependabot-flagged packages (@vitest/browser, form-data, undici,
brace-expansion, js-yaml, esbuild, dompurify, @babel/core, vite,
@opentelemetry/core via posthog-js). Remove the harmful langsmith
override (it forced the vulnerable 0.5.x line) and the zero-effect
lodash-es override.
Signed-off-by: Sacha Al Himdani <sacha@probo.com>
Replace the duplicated per-workspace eslint.config.mjs files in
apps/console, apps/trust, packages/ui, and packages/eslint-config with
one root eslint.config.mjs that reuses the shared @probo/eslint-config
rule sets and scopes them per directory. Linting now runs from the repo
root, so pin the type-checked project service root and broaden the
import-x resolver to every workspace tsconfig (the #/* aliases live in
each app's tsconfig.app.json).
Drop the now-redundant per-package lint scripts and lint-only devDeps,
and add a root lint script that runs eslint over the four dirs with
multithreading restored via --concurrency auto, then lints n8n-node
through a direct workspace call. packages/n8n-node keeps its own
external preset.
Collapse the redundant lint-js -> npm-lint Makefile chain into a single
lint-js target and update the make docs accordingly.
Signed-off-by: Émile Ré <emile@probo.com>
Relay no longer needs a single merged schema.graphql: each project in
relay.config.json now reads the split graphql/*.graphql files directly
via `schema` (base.graphql) plus `schemaExtensions`. gqlgen already
consumed the split files, so the merge step only fed Relay and the
optional IDE GraphQL extension.
Remove the merge machinery (contrib/merge-graphql-schema.sh, the
RELAY_SCHEMAS make rules, and the gitignore entry) and drop the
graphql-config files (apps/trust/graphql.config.yml and the root
package.json graphql field); the Relay extension provides schema-aware
language features from relay.config.json on its own.
relay-compiler keeps generated artifacts in sync (stale ones are
removed automatically), so the relay npm script just runs the local
relay-compiler and the make target delegates to it.
Signed-off-by: Émile Ré <emile@probo.com>
Bump React 19.2, Relay 21, React Router 8, Vite 8 with
@vitejs/plugin-react 6, ESLint 10, GraphQL 17, TypeScript 6,
@types/node 24, and Tailwind 4.3 across the workspaces.
vite-plugin-react 6 (Vite 8) no longer runs Babel, so the Relay
tagged-template transform now runs through @rolldown/plugin-babel
in the console and trust Vite configs.
Relay 21 ships first-party types and enables the ambiguous-alias
check by default; disable that flag to preserve existing queries
and add explicit usePreloadedQuery type arguments where the new
types no longer infer the operation. TypeScript 6 deprecations and
stricter inference are addressed in tsconfigs and call sites.
Keep n8n-node on ESLint 9 and eslint-plugin-react on 7.37.5, the
newest releases compatible with their toolchains.
Signed-off-by: Émile Ré <emile@probo.com>
@n8n/node-cli pulls LangChain and n8n-workflow packages that require
incompatible uuid versions (^10, ^11, ^13). Force uuid 14.0.0 via npm
overrides and refresh the lockfile so audit can apply the security fix.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Interactive playground with themed banner, headless components,
and debug tabs demonstrating programmatic consent access via
getConsent() across separate bundles.
Signed-off-by: Émile Ré <emile@probo.com>
Pulls fixes for the cluster of advisories filed against 1.15.0:
prototype-pollution gadgets in resolveConfig/mergeConfig, CRLF
injection in headers and multipart bodies, no_proxy bypass via
RFC 1122 loopback subnet and IP aliases, parseReviver tampering,
withXSRFToken cross-origin leakage, validateStatus auth bypass,
and AxiosURLSearchParams null-byte injection. Addressed across
axios 1.15.1, 1.15.2, and 1.16.0.
axios is only present as a transitive peer dep (ibm-cloud-sdk-core);
the override forces a single 1.16.0 resolution.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
langsmith <=0.5.18 leaks streamed LLM output past redaction controls
(GHSA-rr7j-v2q5-chgv). The transitive pin via @n8n/ai-utilities held
@langchain/classic at 1.0.5 which required langsmith ^0.3.64, blocking
the upgrade. Add npm overrides for @langchain/classic (^1.0.27) and
langsmith (^0.5.19) to resolve all three langsmith advisories.
The lockfile refresh bumps eslint-plugin-react-hooks from 7.0.1 to
7.1.0 which enables the react-hooks/refs and set-state-in-effect
rules. Fix the resulting lint errors:
- PDFPreview (console + trust): read currentPage through a ref synced
via useEffect, keeping the setState updater pure and ref access
outside of render
- MeasuresPage: remove redundant categoryFilter state that mirrored
urlCategory, use a ref to detect URL changes and trigger refetch
as the single source of category refetches
- WebhooksSettingsPage: defer loadEvents via requestAnimationFrame
to avoid synchronous setState within the effect body
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Update GNUmakefile targets to use wildcard graphql/*.graphql
prerequisites instead of the deleted schema.graphql files, and
remove v1_resolver.go from build prerequisites.
Also update .gitattributes, package.json graphql.schema path,
and AGENTS.md.
Signed-off-by: Émile Ré <emile@getprobo.com>
Consolidate the two per-app relay configs (console and trust)
into a single multi-project relay.config.json at the repo root
with three projects: core, iam, and trust. Bump all relay
packages from v19 to v20.1.1 and move relay-compiler to the
root devDependencies. Replace per-workspace relay scripts with
a single root-level npm run relay command and update the
GNUmakefile, CI workflows, and docs accordingly.
Signed-off-by: Émile Ré <emile@getprobo.com>
Add npm overrides for lodash and lodash-es to force version 4.18.1,
fixing CVE for code injection via _.template and prototype pollution
via _.unset and _.omit.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The root brace-expansion@5 override broke minimatch@3 (used by
@eslint/config-array) because v5 changed the export API. Add a
scoped override so minimatch@3 gets brace-expansion@1.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
