github-featured/triggerdotdev--trigger.dev
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity
Files
f1736595cde96d2dcc6d5a74b62e92c5e4aecd16
triggerdotdev--trigger.dev/package.json
T
nicktrn 91fd8a8a03 chore(security): close dependabot alerts q2 (#3456) 
Closes ~80 dependabot alerts (3 critical, ~25 high, ~31 medium) by
bumping direct deps where possible and narrowly overriding the rest.
Cloud uses `resend` email transport and Node 20 - all bumps are safe for
both cloud and self-hosters.

## Direct upgrades

| Package | Where | From | To | Why |
|---|---|---|---|---|
| `vite` | root devDeps | ^5.4.21 | *(removed)* | dead pin; vitest pulls
vite transitively |
| `dompurify` | apps/webapp | ^3.2.6 | ^3.4.1 | XSS CVEs |
| `effect` | apps/webapp | ^3.11.7 | ^3.21.2 | AsyncLocalStorage CVE in
Effect fibers |
| `nodemailer` | internal-packages/emails | ^7.0.11 | ^8.0.6 | SMTP CRLF
injection (only affects self-hosters w/ smtp/aws-ses transport) |
| `uuid` | apps/webapp | ^9.0.0 | ^14.0.0 | buffer bounds check;
ESM-only but bundled by Remix |
| `uuid` + `@types/uuid` | packages/trigger-sdk | ^9.0.0 | *(removed)* |
dead deps, no usage |
| `@types/uuid` | apps/webapp | ^9.0.0 | *(removed)* | uuid 14 ships its
own types |
| `tar` | packages/cli-v3 | ^7.5.4 | ^7.5.13 | path traversal CVEs |
| `testcontainers` + `@testcontainers/postgresql` +
`@testcontainers/redis` | internal-packages/testcontainers | ^10.28.0 |
^11.14.0 | dev/test cleanup; one-line API fix for
`RedisContainer(image)` |
| `rimraf` | webapp + 6 packages | ^3.0.2 / ^5.0.7 | ^6.0.1 | dev/build
tool consolidation |

## Scoped overrides

All bound by both `>=` and `<` to avoid major-version yanks.

| Override | Closes |
|---|---|
| `tar@>=7 <7.5.11` → `^7.5.11` | supervisor's `@kubernetes/client-node
1.0.0` chain |
| `axios@>=1.0.0 <1.15.0` → `^1.15.0` | replaces older 1.9.0 pin |
| `systeminformation@>=5.0.0 <5.31.0` → `^5.31.0` | bumps existing
5.27.14 pin |
| `lodash@>=4.0.0 <4.18.0` → `^4.18.0` | bumps existing 4.17.23 pin |
| `lodash-es@>=4.0.0 <4.18.0` → `^4.18.0` | new (mirrors lodash) |
| `dompurify@>=3 <3.4.0` → `^3.4.1` | catches transitive dompurify via
mermaid |
| `vite@>=5.0.0 <6.4.2` → `^6.4.2` | path traversal; vite 5 has no patch
|
| `rollup@>=4 <4.59.0` → `^4.59.0` | path traversal in vite/vitest chain
|
| `flatted@>=3 <3.4.2` → `^3.4.2` | prototype pollution in eslint
flat-cache |
| `picomatch@>=2 <2.3.2` → `^2.3.2` | ReDoS in 2.x branch (transitive) |
| `picomatch@>=4 <4.0.4` → `^4.0.4` | ReDoS in 4.x branch
(vitest/tinyglobby) |
| `minimatch@>=3 <3.1.3` → `^3.1.3` | ReDoS in eslint 8 chain |
| `protobufjs@>=7 <7.5.5` → `^7.5.5` | **critical** RCE via
@opentelemetry/otlp-transformer |
| `fast-xml-parser@>=4 <4.5.5` → `^4.5.5` | DOCTYPE bypass + others (4.x
branch via aws-sdk in supervisor) |
| `fast-xml-parser@>=5 <5.7.0` → `^5.7.0` | **critical** + others (5.x
branch via aws-sdk in webapp) |
| `path-to-regexp@>=0.1 <0.1.13` → `^0.1.13` | ReDoS in express 4 /
@remix-run/express |
| `ajv@>=8 <8.18.0` → `^8.18.0` | DoS |
| `socket.io-parser@>=4 <4.2.6` → `^4.2.6` | DoS in @trigger.dev/core's
socket.io |
| `postcss@>=8 <8.5.10` → `^8.5.10` | XSS via stringify |
| `yaml@>=2 <2.8.3` → `^2.8.3` | DoS |
| `semver@>=5 <5.7.2` → `^5.7.2` | ReDoS in 5.x |
| `defu@>=6 <6.1.5` → `^6.1.5` | prototype pollution via __proto__ in
@prisma/config c12 chain |

## Dismissed (~47)

| Reason | Cluster | Count |
|---|---|---|
| `not_used` | langsmith + next 15.x in references/* | 10 |
| `not_used` | minimatch 8.x via prisma-generator-ts-enums
(references/prisma-6) | 3 |
| `not_used` | basic-ftp via puppeteer in references/hello-world +
references/seed | 2 |
| `not_used` | hono / @hono/node-server / express-rate-limit /
path-to-regexp 8.x / @modelcontextprotocol/sdk - all via mcp-sdk chain
(dormant in webapp; dev-only localhost in cli-v3) | 22 |
| `not_used` | fastify / @fastify/static / file-type via evalite devDep
| 5 |
| `tolerable_risk` | rollup 3 + minimatch 5/8/9/10 dev/build tooling |
13 |

## Notes

- **mcp-sdk chain**: `@vercel/sdk` in webapp imports `Vercel` API client
only; `mcp-server/*` subpath isn't loaded at runtime. cli-v3's MCP
server runs only via `trigger mcp` on developer machines. Bumping
`@modelcontextprotocol/sdk` to latest (1.29.0) wouldn't close these
alerts anyway - it ships hono ^4.11.4 which is still vulnerable - so
dismissal is the cleaner call.
- **References ignore list**: confirmed with current dependabot ignore
config; added `references/seed/package.json` (only gap).
- **undici** alerts (CVE-2026-1527, 4 alerts) will auto-close: lockfile
already at 6.25.0 > patched 6.24.0; just needs Dependabot rescan.
- **Effect 3.20 fix** is a runtime-only scheduler fix, no public API
changes - verified with research agent against our four `effect/*`
imports.
- **uuid 14** is ESM-only; we only call `validate`/`version` (no crypto
needed) so Node 20 requirement isn't load-bearing for us.
## Public packages (`packages/*`)

Minimal surface, deliberately. None of these change published runtime
behaviour - all changesets-worthy public package changes are deferred to
a regular release pass.

| Package | Change | Runtime impact |
|---|---|---|
| `packages/trigger-sdk` | Removed dead `uuid` dep (no source imports) |
None - dep was unused |
| `packages/cli-v3` | `tar` ^7.5.4 → ^7.5.13 | Patch bump within
already-allowed 7.x range; nothing CLI consumers see |
| `packages/core` / `packages/build` / `packages/python` /
`packages/rsc` / `packages/react-hooks` / `packages/schema-to-json` |
`rimraf` ^3.0.2 → ^6.0.1 in devDeps | Build-time only, no runtime change
|

No changeset added because nothing in these packages affects what
published consumers run.

## Validation

- Webapp typecheck (forced, no cache) passes after every commit
- Smoke-tested testcontainers v11 changes via real `postgresTest` +
`redisTest` (sync.test.ts, releaseConcurrency.test.ts) - both pass
- Webapp built + verified `require("uuid")` no longer in CJS server
output (now bundled inline)
- Test env webapp deployed at `dependabot-q2.rc0` (cloud#740) - no
issues observed
- Test suite run with package prerelease passed
2026-04-28 10:22:44 +01:00

141 lines
5.4 KiB
JSON
Raw Blame History

{
"name": "triggerdotdev",
"private": true,
"workspaces": [
"apps/*",
"packages/*",
"integrations/*"
],
"version": "0.0.1",
"scripts": {
"build": "turbo run build",
"build:force": "turbo run build --force",
"build:db:seed": "turbo run build:db:seed",
"db:migrate": "turbo run db:migrate:deploy generate",
"db:seed": "turbo run db:seed",
"db:studio": "turbo run db:studio",
"db:populate": "turbo run db:populate",
"dev": "turbo run dev",
"i:dev": "infisical run -- turbo run dev",
"generate": "turbo run generate",
"lint": "turbo run lint",
"docker": "docker compose -p triggerdotdev-docker -f docker/docker-compose.yml up -d --build --remove-orphans",
"docker:stop": "docker compose -p triggerdotdev-docker -f docker/docker-compose.yml stop",
"dev:docker": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml up -d --build --remove-orphans",
"dev:docker:build": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml up -d --build",
"dev:docker:stop": "docker compose -p triggerdotdev-dev-docker -f docker/dev-compose.yml stop",
"test": "turbo run test --concurrency=1 -- --run",
"test:webapp": "turbo run test --filter webapp -- --run",
"test:packages": "turbo run test --concurrency=1 --filter \"@trigger.dev/*\" -- --run",
"test:internal": "turbo run test --concurrency=1 --filter \"@internal/*\" -- --run",
"test:dev": "turbo run test:dev",
"start": "turbo run start",
"check-exports": "turbo run check-exports",
"clean": "turbo run clean",
"clean:node_modules": "find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +",
"typecheck": "turbo run typecheck",
"test:e2e": "playwright test",
"test:e2e:ui": "playwright test --ui",
"test:e2e:dev": "turbo run test:e2e:dev",
"test:e2e:ci": "turbo run test:e2e:ci",
"setup": "turbo run generate db:migrate:force db:seed",
"env:pull": "turbo run env:pull",
"changeset:add": "changeset",
"changeset:version": "changeset version",
"changeset:release": "pnpm run build --filter \"@trigger.dev/*\" --filter \"trigger.dev\" && changeset publish",
"changeset:v4": "changeset pre enter v4",
"changeset:normal": "changeset pre exit",
"clean:sourcemaps": "turbo run clean:sourcemaps",
"storybook": "turbo run storybook"
},
"devDependencies": {
"@manypkg/cli": "^0.19.2",
"@playwright/test": "^1.36.2",
"@trigger.dev/database": "workspace:*",
"@types/node": "20.14.14",
"@vitest/coverage-v8": "3.1.4",
"autoprefixer": "^10.4.12",
"eslint-plugin-turbo": "^2.0.4",
"lefthook": "^1.11.3",
"pkg-types": "1.1.3",
"prettier": "^3.0.0",
"tsx": "^3.7.1",
"turbo": "^1.10.3",
"typescript": "5.5.4",
"vite-tsconfig-paths": "^4.0.5",
"vitest": "3.1.4"
},
"packageManager": "pnpm@10.23.0",
"dependencies": {
"@changesets/cli": "2.26.2",
"@remix-run/changelog-github": "^0.0.5",
"agentcrumbs": "^0.5.0",
"node-fetch": "2.6.x"
},
"pnpm": {
"patchedDependencies": {
"@changesets/assemble-release-plan@5.2.4": "patches/@changesets__assemble-release-plan@5.2.4.patch",
"engine.io-parser@5.2.2": "patches/engine.io-parser@5.2.2.patch",
"graphile-worker@0.16.6": "patches/graphile-worker@0.16.6.patch",
"redlock@5.0.0-beta.2": "patches/redlock@5.0.0-beta.2.patch",
"@kubernetes/client-node@1.0.0": "patches/@kubernetes__client-node@1.0.0.patch",
"@sentry/remix@9.46.0": "patches/@sentry__remix@9.46.0.patch",
"@upstash/ratelimit@1.1.3": "patches/@upstash__ratelimit.patch",
"antlr4ts@0.5.0-alpha.4": "patches/antlr4ts@0.5.0-alpha.4.patch",
"@window-splitter/state@0.4.1": "patches/@window-splitter__state@0.4.1.patch"
},
"overrides": {
"typescript": "5.5.4",
"@types/node": "20.14.14",
"express@^4>body-parser": "1.20.3",
"@remix-run/dev@2.17.4>tar-fs": "2.1.4",
"tar@>=7 <7.5.11": "^7.5.11",
"form-data@^2": "2.5.4",
"form-data@^3": "3.0.4",
"form-data@^4": "4.0.4",
"axios@>=1.0.0 <1.15.0": "^1.15.0",
"js-yaml@>=3.0.0 <3.14.2": "3.14.2",
"js-yaml@>=4.0.0 <4.1.1": "4.1.1",
"jws@<3.2.3": "3.2.3",
"qs@>=6.0.0 <6.14.1": "6.14.1",
"systeminformation@>=5.0.0 <5.31.0": "^5.31.0",
"lodash@>=4.17 <4.18.0": "^4.18.0",
"lodash-es@>=4.17 <4.18.0": "^4.18.0",
"dompurify@>=3 <3.4.0": "^3.4.1",
"vite@>=5.0.0 <6.4.2": "^6.4.2",
"rollup@>=4 <4.59.0": "^4.59.0",
"flatted@>=3 <3.4.2": "^3.4.2",
"picomatch@>=2 <2.3.2": "^2.3.2",
"picomatch@>=4 <4.0.4": "^4.0.4",
"minimatch@>=3 <3.1.3": "^3.1.3",
"protobufjs@>=7 <7.5.5": "^7.5.5",
"fast-xml-parser@>=4 <4.5.5": "^4.5.5",
"fast-xml-parser@>=5 <5.7.0": "^5.7.0",
"path-to-regexp@>=0.1 <0.1.13": "^0.1.13",
"ajv@>=8 <8.18.0": "^8.18.0",
"socket.io-parser@>=4 <4.2.6": "^4.2.6",
"postcss@>=8 <8.5.10": "^8.5.10",
"yaml@>=2 <2.8.3": "^2.8.3",
"semver@>=5 <5.7.2": "^5.7.2",
"defu@>=6 <6.1.5": "^6.1.5"
},
"onlyBuiltDependencies": [
"@depot/cli",
"@fingerprintjs/fingerprintjs-pro-react",
"@prisma/client",
"@prisma/engines",
"@sentry/cli",
"@swc/core",
"better-sqlite3",
"cpu-features",
"esbuild",
"lefthook",
"prisma",
"protobufjs",
"sharp",
"ssh2",
"turbo"
]
}
}
Reference in New Issue View Git Blame Copy Permalink