@n8n/node-cli pulls LangChain and n8n-workflow packages that require
incompatible uuid versions (^10, ^11, ^13). Force uuid 14.0.0 via npm
overrides and refresh the lockfile so audit can apply the security fix.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Interactive playground with themed banner, headless components,
and debug tabs demonstrating programmatic consent access via
getConsent() across separate bundles.
Signed-off-by: Émile Ré <emile@probo.com>
Pulls fixes for the cluster of advisories filed against 1.15.0:
prototype-pollution gadgets in resolveConfig/mergeConfig, CRLF
injection in headers and multipart bodies, no_proxy bypass via
RFC 1122 loopback subnet and IP aliases, parseReviver tampering,
withXSRFToken cross-origin leakage, validateStatus auth bypass,
and AxiosURLSearchParams null-byte injection. Addressed across
axios 1.15.1, 1.15.2, and 1.16.0.
axios is only present as a transitive peer dep (ibm-cloud-sdk-core);
the override forces a single 1.16.0 resolution.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
langsmith <=0.5.18 leaks streamed LLM output past redaction controls
(GHSA-rr7j-v2q5-chgv). The transitive pin via @n8n/ai-utilities held
@langchain/classic at 1.0.5 which required langsmith ^0.3.64, blocking
the upgrade. Add npm overrides for @langchain/classic (^1.0.27) and
langsmith (^0.5.19) to resolve all three langsmith advisories.
The lockfile refresh bumps eslint-plugin-react-hooks from 7.0.1 to
7.1.0 which enables the react-hooks/refs and set-state-in-effect
rules. Fix the resulting lint errors:
- PDFPreview (console + trust): read currentPage through a ref synced
via useEffect, keeping the setState updater pure and ref access
outside of render
- MeasuresPage: remove redundant categoryFilter state that mirrored
urlCategory, use a ref to detect URL changes and trigger refetch
as the single source of category refetches
- WebhooksSettingsPage: defer loadEvents via requestAnimationFrame
to avoid synchronous setState within the effect body
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
Update GNUmakefile targets to use wildcard graphql/*.graphql
prerequisites instead of the deleted schema.graphql files, and
remove v1_resolver.go from build prerequisites.
Also update .gitattributes, package.json graphql.schema path,
and AGENTS.md.
Signed-off-by: Émile Ré <emile@getprobo.com>
Consolidate the two per-app relay configs (console and trust)
into a single multi-project relay.config.json at the repo root
with three projects: core, iam, and trust. Bump all relay
packages from v19 to v20.1.1 and move relay-compiler to the
root devDependencies. Replace per-workspace relay scripts with
a single root-level npm run relay command and update the
GNUmakefile, CI workflows, and docs accordingly.
Signed-off-by: Émile Ré <emile@getprobo.com>
Add npm overrides for lodash and lodash-es to force version 4.18.1,
fixing CVE for code injection via _.template and prototype pollution
via _.unset and _.omit.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
The root brace-expansion@5 override broke minimatch@3 (used by
@eslint/config-array) because v5 changed the export API. Add a
scoped override so minimatch@3 gets brace-expansion@1.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
