Skip to content

Commit 7eadf89

Browse files
authored
fix: Upgrade packages (#40935)
## Description - Upgrades packages reported by Dependabot: - `nanoid` - `brace-expansion` - `webpack-dev-server` - `path-to-regexp` - `vite` - `http-proxy-middleware` Fixes the following issues - https://github.com/appsmithorg/appsmith/security/dependabot/416 - https://github.com/appsmithorg/appsmith/security/dependabot/406 - https://github.com/appsmithorg/appsmith/security/dependabot/408 - https://github.com/appsmithorg/appsmith/security/dependabot/332 - https://github.com/appsmithorg/appsmith/security/dependabot/361 - https://github.com/appsmithorg/appsmith/security/dependabot/415 - https://github.com/appsmithorg/appsmith/security/dependabot/414 - https://github.com/appsmithorg/appsmith/security/dependabot/413 - https://github.com/appsmithorg/appsmith/security/dependabot/418 ## Automation /ok-to-test tags="@tag.All" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!TIP] > 🟢 🟢 🟢 All cypress tests have passed! 🎉 🎉 🎉 > Workflow run: <https://github.com/appsmithorg/appsmith/actions/runs/15630439422> > Commit: 2b6f4a4 > <a href="https://internal.appsmith.com/app/cypress-dashboard/rundetails-65890b3c81d7400d08fa9ee5?branch=master&workflowId=15630439422&attempt=2" target="_blank">Cypress dashboard</a>. > Tags: `@tag.All` > Spec: > <hr>Fri, 13 Jun 2025 10:49:32 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Improved development server configuration for enhanced compatibility and middleware management. - **Bug Fixes** - Updated unique key generation to ensure consistency and reliability across the application. - **Chores** - Upgraded and adjusted dependencies for better stability and security. - Refined package resolution to address version conflicts. - **Style** - Standardized string formatting and code styling in development scripts. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 parent dea1c03 commit 7eadf89

File tree

11 files changed

+501
-335
lines changed

11 files changed

+501
-335
lines changed

app/client/config/webpackDevServer.config.js

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,21 @@ module.exports = function (proxy, allowedHost) {
8989
publicPath: paths.publicUrlOrPath.slice(0, -1),
9090
},
9191

92-
https: getHttpsConfig(),
92+
// Determine server protocol (http/https) per WDS v5 `server` option
93+
server: (() => {
94+
const httpsConfig = getHttpsConfig();
95+
if (httpsConfig) {
96+
if (typeof httpsConfig === "object") {
97+
return {
98+
type: "https",
99+
options: httpsConfig,
100+
};
101+
}
102+
// boolean true means use basic https
103+
return "https";
104+
}
105+
return "http";
106+
})(),
93107
host,
94108
historyApiFallback: {
95109
// Paths with dots should still use the history fallback.
@@ -99,27 +113,23 @@ module.exports = function (proxy, allowedHost) {
99113
},
100114
// `proxy` is run between `before` and `after` `webpack-dev-server` hooks
101115
proxy,
102-
onBeforeSetupMiddleware(devServer) {
103-
// Keep `evalSourceMapMiddleware`
104-
// middlewares before `redirectServedPath` otherwise will not have any effect
105-
// This lets us fetch source contents from webpack for the error overlay
106-
devServer.app.use(evalSourceMapMiddleware(devServer));
116+
setupMiddlewares(middlewares, devServer) {
117+
// ------------------------------
118+
// Replaces deprecated onBeforeSetupMiddleware and onAfterSetupMiddleware.
119+
// For details see: https://github.com/webpack/webpack-dev-server/blob/master/migration-v5.md
120+
// ------------------------------
121+
// Equivalent of previous onBeforeSetupMiddleware
122+
middlewares.unshift(evalSourceMapMiddleware(devServer));
107123

108124
if (fs.existsSync(paths.proxySetup)) {
109-
// This registers user provided middleware for proxy reasons
110125
require(paths.proxySetup)(devServer.app);
111126
}
112-
},
113-
onAfterSetupMiddleware(devServer) {
114-
// Redirect to `PUBLIC_URL` or `homepage` from `package.json` if url not match
115-
devServer.app.use(redirectServedPath(paths.publicUrlOrPath));
116127

117-
// This service worker file is effectively a 'no-op' that will reset any
118-
// previous service worker registered for the same host:port combination.
119-
// We do this in development to avoid hitting the production cache if
120-
// it used the same host and port.
121-
// https://github.com/facebook/create-react-app/issues/2272#issuecomment-302832432
122-
devServer.app.use(noopServiceWorkerMiddleware(paths.publicUrlOrPath));
128+
// Equivalent of previous onAfterSetupMiddleware (executed last)
129+
middlewares.push(redirectServedPath(paths.publicUrlOrPath));
130+
middlewares.push(noopServiceWorkerMiddleware(paths.publicUrlOrPath));
131+
132+
return middlewares;
123133
},
124134
};
125135
};

app/client/jest.config.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ module.exports = {
3939
moduleFileExtensions: ["ts", "tsx", "js", "jsx", "json", "node", "css"],
4040
moduleDirectories: ["node_modules", "src", "test"],
4141
transformIgnorePatterns: [
42-
"<rootDir>/node_modules/(?!codemirror|konva|react-dnd|dnd-core|@babel|(@blueprintjs)|@github|lodash-es|@draft-js-plugins|react-documents|linkedom|assert-never|axios|usehooks-ts|date-fns)",
42+
"<rootDir>/node_modules/(?!codemirror|konva|react-dnd|dnd-core|@babel|(@blueprintjs)|@github|lodash-es|@draft-js-plugins|react-documents|linkedom|assert-never|axios|usehooks-ts|date-fns|nanoid)",
4343
],
4444
moduleNameMapper: {
4545
"\\.(css|less)$": "<rootDir>/test/__mocks__/styleMock.js",

app/client/package.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -157,7 +157,7 @@
157157
"moment": "2.29.4",
158158
"moment-timezone": "^0.5.35",
159159
"mutative": "^1.1.0",
160-
"nanoid": "^2.0.4",
160+
"nanoid": "3.3.11",
161161
"node-forge": "^1.3.0",
162162
"object-hash": "^3.0.0",
163163
"openai": "4.87.3",
@@ -270,7 +270,6 @@
270270
"@types/lodash": "^4.14.120",
271271
"@types/mixpanel-browser": "^2.50.1",
272272
"@types/moment-timezone": "^0.5.10",
273-
"@types/nanoid": "^2.0.0",
274273
"@types/node": "^10.12.18",
275274
"@types/node-fetch": "^2.6.11",
276275
"@types/node-forge": "^0.10.0",
@@ -392,7 +391,7 @@
392391
"ts-jest-mock-import-meta": "^0.12.0",
393392
"ts-node": "^10.9.1",
394393
"webpack": "^5.98.0",
395-
"webpack-dev-server": "^4.6.0",
394+
"webpack-dev-server": "5.2.2",
396395
"webpack-manifest-plugin": "^4.0.2",
397396
"webpack-retry-chunk-load-plugin": "^3.1.1",
398397
"workbox-webpack-plugin": "^7.3.0",
@@ -425,6 +424,7 @@
425424
"@types/react": "^17.0.2",
426425
"postcss": "8.4.31",
427426
"axios": "^1.8.3",
428-
"esbuild": "^0.25.1"
427+
"esbuild": "^0.25.1",
428+
"path-to-regexp@^1.7.0": "1.9.0"
429429
}
430-
}
430+
}

app/client/packages/dsl/src/migrate/utils.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* eslint-disable @typescript-eslint/no-explicit-any */
2-
import generate from "nanoid/generate";
2+
import { customAlphabet } from "nanoid";
33
import type { DSLWidget, WidgetProps } from "./types";
44
import { isString } from "lodash";
55

@@ -11,7 +11,7 @@ const ALPHANUMERIC = "1234567890abcdefghijklmnopqrstuvwxyz";
1111
export const generateReactKey = ({
1212
prefix = "",
1313
}: { prefix?: string } = {}): string => {
14-
return prefix + generate(ALPHANUMERIC, 10);
14+
return prefix + customAlphabet(ALPHANUMERIC, 10)();
1515
};
1616

1717
export const removeSpecialChars = (value: string, limit?: number) => {

app/client/packages/storybook/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
"@vitejs/plugin-react": "^4.3.1",
3333
"chromatic": "^11.3.0",
3434
"storybook": "8.2.7",
35-
"vite": "^6.2.6",
35+
"vite": "^6.2.7",
3636
"vite-plugin-svgr": "^4.2.0"
3737
},
3838
"dependencies": {

app/client/scripts/start.js

Lines changed: 43 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,38 @@
1-
'use strict';
1+
"use strict";
22

33
// Do this as the first thing so that any code reading it knows the right env.
4-
process.env.BABEL_ENV = 'development';
5-
process.env.NODE_ENV = 'development';
4+
process.env.BABEL_ENV = "development";
5+
process.env.NODE_ENV = "development";
66

77
// Makes the script crash on unhandled rejections instead of silently
88
// ignoring them. In the future, promise rejections that are not handled will
99
// terminate the Node.js process with a non-zero exit code.
10-
process.on('unhandledRejection', err => {
10+
process.on("unhandledRejection", (err) => {
1111
throw err;
1212
});
1313

1414
// Ensure environment variables are read.
15-
require('../config/env');
15+
require("../config/env");
1616

17-
const fs = require('fs');
18-
const chalk = require('react-dev-utils/chalk');
19-
const webpack = require('webpack');
20-
const WebpackDevServer = require('webpack-dev-server');
21-
const clearConsole = require('react-dev-utils/clearConsole');
22-
const checkRequiredFiles = require('react-dev-utils/checkRequiredFiles');
17+
const fs = require("fs");
18+
const chalk = require("react-dev-utils/chalk");
19+
const webpack = require("webpack");
20+
const WebpackDevServer = require("webpack-dev-server");
21+
const clearConsole = require("react-dev-utils/clearConsole");
22+
const checkRequiredFiles = require("react-dev-utils/checkRequiredFiles");
2323
const {
2424
choosePort,
2525
createCompiler,
2626
prepareProxy,
2727
prepareUrls,
28-
} = require('react-dev-utils/WebpackDevServerUtils');
29-
const openBrowser = require('react-dev-utils/openBrowser');
30-
const semver = require('semver');
31-
const paths = require('../config/paths');
32-
const configFactory = require('../config/webpack.config');
33-
const createDevServerConfig = require('../config/webpackDevServer.config');
34-
const getClientEnvironment = require('../config/env');
35-
const react = require(require.resolve('react', { paths: [paths.appPath] }));
28+
} = require("react-dev-utils/WebpackDevServerUtils");
29+
const openBrowser = require("react-dev-utils/openBrowser");
30+
const semver = require("semver");
31+
const paths = require("../config/paths");
32+
const configFactory = require("../config/webpack.config");
33+
const createDevServerConfig = require("../config/webpackDevServer.config");
34+
const getClientEnvironment = require("../config/env");
35+
const react = require(require.resolve("react", { paths: [paths.appPath] }));
3636

3737
const env = getClientEnvironment(paths.publicUrlOrPath.slice(0, -1));
3838
const useYarn = fs.existsSync(paths.yarnLockFile);
@@ -45,50 +45,50 @@ if (!checkRequiredFiles([paths.appHtml, paths.appIndexJs])) {
4545

4646
// Tools like Cloud9 rely on this.
4747
const DEFAULT_PORT = parseInt(process.env.PORT, 10) || 3000;
48-
const HOST = process.env.HOST || '0.0.0.0';
48+
const HOST = process.env.HOST || "0.0.0.0";
4949

5050
if (process.env.HOST) {
5151
console.log(
5252
chalk.cyan(
5353
`Attempting to bind to HOST environment variable: ${chalk.yellow(
54-
chalk.bold(process.env.HOST)
55-
)}`
56-
)
54+
chalk.bold(process.env.HOST),
55+
)}`,
56+
),
5757
);
5858
console.log(
59-
`If this was unintentional, check that you haven't mistakenly set it in your shell.`
59+
`If this was unintentional, check that you haven't mistakenly set it in your shell.`,
6060
);
6161
console.log(
62-
`Learn more here: ${chalk.yellow('https://cra.link/advanced-config')}`
62+
`Learn more here: ${chalk.yellow("https://cra.link/advanced-config")}`,
6363
);
6464
console.log();
6565
}
6666

6767
// We require that you explicitly set browsers and do not fall back to
6868
// browserslist defaults.
69-
const { checkBrowsers } = require('react-dev-utils/browsersHelper');
69+
const { checkBrowsers } = require("react-dev-utils/browsersHelper");
7070
checkBrowsers(paths.appPath, isInteractive)
7171
.then(() => {
7272
// We attempt to use the default port but if it is busy, we offer the user to
7373
// run on a different port. `choosePort()` Promise resolves to the next free port.
7474
return choosePort(HOST, DEFAULT_PORT);
7575
})
76-
.then(port => {
76+
.then((port) => {
7777
if (port == null) {
7878
// We have not found a port.
7979
return;
8080
}
8181

82-
const config = configFactory('development');
83-
const protocol = process.env.HTTPS === 'true' ? 'https' : 'http';
82+
const config = configFactory("development");
83+
const protocol = process.env.HTTPS === "true" ? "https" : "http";
8484
const appName = require(paths.appPackageJson).name;
8585

8686
const useTypeScript = fs.existsSync(paths.appTsConfig);
8787
const urls = prepareUrls(
8888
protocol,
8989
HOST,
9090
port,
91-
paths.publicUrlOrPath.slice(0, -1)
91+
paths.publicUrlOrPath.slice(0, -1),
9292
);
9393
// Create a webpack compiler that is configured with custom messages.
9494
const compiler = createCompiler({
@@ -104,7 +104,7 @@ checkBrowsers(paths.appPath, isInteractive)
104104
const proxyConfig = prepareProxy(
105105
proxySetting,
106106
paths.appPublic,
107-
paths.publicUrlOrPath
107+
paths.publicUrlOrPath,
108108
);
109109
// Serve webpack assets generated by the compiler over a web server.
110110
const serverConfig = {
@@ -119,34 +119,34 @@ checkBrowsers(paths.appPath, isInteractive)
119119
clearConsole();
120120
}
121121

122-
if (env.raw.FAST_REFRESH && semver.lt(react.version, '16.10.0')) {
122+
if (env.raw.FAST_REFRESH && semver.lt(react.version, "16.10.0")) {
123123
console.log(
124124
chalk.yellow(
125-
`Fast Refresh requires React 16.10 or higher. You are using React ${react.version}.`
126-
)
125+
`Fast Refresh requires React 16.10 or higher. You are using React ${react.version}.`,
126+
),
127127
);
128128
}
129129

130-
console.log(chalk.cyan('Starting the development server...\n'));
130+
console.log(chalk.cyan("Starting the development server...\n"));
131131
openBrowser(urls.localUrlForBrowser);
132132
});
133133

134-
['SIGINT', 'SIGTERM'].forEach(function (sig) {
134+
["SIGINT", "SIGTERM"].forEach(function (sig) {
135135
process.on(sig, function () {
136-
devServer.close();
137-
process.exit();
136+
console.log(chalk.yellow("Stopping the development server..."));
137+
devServer.stop().then(() => process.exit());
138138
});
139139
});
140140

141-
if (process.env.CI !== 'true') {
141+
if (process.env.CI !== "true") {
142142
// Gracefully exit when stdin ends
143-
process.stdin.on('end', function () {
144-
devServer.close();
145-
process.exit();
143+
process.stdin.on("end", function () {
144+
console.log(chalk.yellow("Stopping the development server..."));
145+
devServer.stop().then(() => process.exit());
146146
});
147147
}
148148
})
149-
.catch(err => {
149+
.catch((err) => {
150150
if (err && err.message) {
151151
console.log(err.message);
152152
}

app/client/src/instrumentation/utils.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import {
55
osName,
66
osVersion,
77
} from "react-device-detect";
8-
import nanoid from "nanoid";
8+
import { nanoid } from "nanoid";
99
import memoizeOne from "memoize-one";
1010
import { getApplicationParamsFromUrl } from "ee/utils/serviceWorkerUtils";
1111
import { getAppsmithConfigs } from "ee/configs";

app/client/src/usagePulse/utils.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
import { isEditorPath } from "ee/pages/Editor/Explorer/helpers";
22
import { APP_MODE } from "entities/App";
33
import { isNil } from "lodash";
4-
import nanoid from "nanoid";
4+
import { nanoid } from "nanoid";
55
import { getAppMode } from "ee/selectors/entitiesSelector";
66
import store from "store";
77
import AnalyticsUtil from "ee/utils/AnalyticsUtil";
@@ -72,7 +72,7 @@ export const getUsagePulsePayload = (
7272
let fallback = localStorage.getItem(FALLBACK_KEY);
7373

7474
if (!fallback) {
75-
fallback = nanoid() as string;
75+
fallback = nanoid();
7676
localStorage.setItem(FALLBACK_KEY, fallback);
7777
}
7878

app/client/src/utils/generators.tsx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import type { WidgetType } from "constants/WidgetConstants";
2-
import generate from "nanoid/generate";
2+
import { customAlphabet } from "nanoid";
33
import { getBaseWidgetClassName } from "../constants/componentClassNameConstants";
44

55
const ALPHANUMERIC = "1234567890abcdefghijklmnopqrstuvwxyz";
@@ -8,7 +8,7 @@ const ALPHANUMERIC = "1234567890abcdefghijklmnopqrstuvwxyz";
88
export const generateReactKey = ({
99
prefix = "",
1010
}: { prefix?: string } = {}): string => {
11-
return prefix + generate(ALPHANUMERIC, 10);
11+
return prefix + customAlphabet(ALPHANUMERIC, 10)();
1212
};
1313

1414
// Before you change how this works

app/client/src/widgets/WidgetUtils.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ import {
2121
WIDGET_PADDING,
2222
} from "constants/WidgetConstants";
2323
import { find, isArray, isEmpty } from "lodash";
24-
import generate from "nanoid/generate";
24+
import { customAlphabet } from "nanoid";
2525
import { createGlobalStyle, css } from "styled-components";
2626
import tinycolor from "tinycolor2";
2727
import type { DynamicPath } from "utils/DynamicBindingUtils";
@@ -117,7 +117,7 @@ const ALPHANUMERIC = "1234567890abcdefghijklmnopqrstuvwxyz";
117117
export const generateReactKey = ({
118118
prefix = "",
119119
}: { prefix?: string } = {}): string => {
120-
return prefix + generate(ALPHANUMERIC, 10);
120+
return prefix + customAlphabet(ALPHANUMERIC, 10)();
121121
};
122122

123123
export const getCustomTextColor = (theme: Theme, backgroundColor?: string) => {

0 commit comments

Comments
 (0)