mirror of
https://github.com/zitadel/zitadel.git
synced 2026-10-25 23:50:11 -05:00
c1e5deea42
# Which Problems Are Solved - Several npm dependencies fell behind releases that contain security fixes (`pnpm audit` reported 36 findings, 12 of them high). - Some `pnpm-workspace.yaml` overrides had outdated floors or comments that no longer named the parent pinning the old version. # How the Problems Are Solved Direct bumps: | package | from | to | where | type | |---|---|---|---|---| | `next` | 16.3.6 | 16.3.8 | login, docs | patch | | `@next/eslint-plugin-next` | 16.3.6 | 16.3.8 | login | patch | | `@angular/*` framework packages (core, common, router, forms, …) | 21.2.24 | 21.2.25 | console | patch | | `@angular/build`, `@angular/cli` | 21.2.24 | 21.2.27 | console | patch | | `moment` | 2.30.1 | 2.31.0 | login, console | minor | | `concurrently` | 10.0.3 | 10.0.6 | login | patch | | `vitest` | 4.1.11 | 4.1.12 | login, `@zitadel/client` | patch | Lockfile refreshes within existing ranges: - `hono` 4.13.9 → 4.13.13 (via `@modelcontextprotocol/sdk`) - along with these, a few webpack subtree packages in docs (`raw-loader` → `webpack`) moved by a patch or minor version: `schema-utils`, `watchpack`, `minimizer-webpack-plugin`, `browserslist` - other transitive dependencies refreshed within their ranges Removed: - `@tailwindcss/typography` from docs (unused) Overrides: all existing overrides were removed, dependencies reinstalled, and only the ones `pnpm audit` still needs were re-added. On top of that, this PR adds new overrides for packages whose latest parent release still pins a vulnerable version. Each override is scoped to the vulnerable range and names the parent that pins it: | override | pinned by | |---|---| | `axios@>=1.0.0 <1.20.0` → `^1.20.0` (new) | nx 22.7.12 (latest 22.x) | | `follow-redirects@<1.16.1` → `^1.16.1` (new) | nx 22.7.12 (latest 22.x) | | `brace-expansion@>=4.0.0 <5.0.12` → `^5.0.12` (floor raised) | nx 22.7.12 | | `smol-toml@<1.9.0` → `^1.9.0` (floor raised) | nx 22.7.12 | | `@modelcontextprotocol/sdk@<1.32.0` → `^1.32.0` (new) | `@angular/cli` 21.2.27 (latest 21.x) | | `vite@>=7.0.0 <7.3.7` → `^7.3.7` (new) | `@angular/build` 21.2.27 (latest 21.x) | | `esbuild@>=0.27.3 <0.28.1` → `^0.28.1` | tsup 8.x (via `@zitadel/client`) | | `@opentelemetry/core`, `@opentelemetry/propagator-jaeger` | login's `@opentelemetry/sdk-node` 0.218 and `auto-instrumentations-node` 0.76 | Every new override stays within the same major version. # Additional Changes None of the bumps is a major release, and none changes anything operators can observe. Manual checks: - Login: `/ui/v2/login/loginname`, the password and passkey flows, and the image-heavy pages (Next 16.3.8). - Console: navigating between orgs, projects and users, including deep links and the back button (Angular router 21.2.25). - Docs: start the dev server and open a few MDX pages (vite override via `fumadocs-mdx`). # Additional Context Still open in `pnpm audit` on purpose (11 packages: 9 moderate, 2 high): - 8 `@opentelemetry/instrumentation-*` DB packages in login, pinned by `auto-instrumentations-node` 0.76. The bump to sdk-node 0.222+ / auto-instrumentations 0.80+ moves HTTP spans to stable semantic conventions, which changes operator dashboards, so it will come as its own PR. - `braces` and `sprintf-js` via `@changesets/cli` 2.x. There is no 2.x fix, and changesets 3 needs Node 22 while `release.yml` uses Node 20. - `node-forge`: there is no upstream fix. Only the dockerized login test CA uses it (`apps/login/dockerized/ca/utils/tls.ts`). Follow-ups that would remove overrides: nx 23/24 (axios, follow-redirects, brace-expansion, smol-toml), tsup 9 (esbuild), Angular 22 (MCP SDK, vite). Verified locally: `pnpm install --frozen-lockfile`, `build test-unit lint` for `@zitadel/login`, `@zitadel/client` and `@zitadel/console`, and `check-types test` for `@zitadel/docs`. I didn't run the docs static `build` locally (not enough disk), so that one relies on CI. I also didn't run the dockerized login tests, because nothing changes the image, containers or telemetry. - Supersedes #12728 (next) and #12892 (moment) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Livio Spring <9405495+livio-a@users.noreply.github.com>