From 6cf424ede20058bf64d73c399ad28f7c64cdcdca Mon Sep 17 00:00:00 2001 From: Luis Cosio Date: Sun, 19 Jul 2026 16:36:47 -0700 Subject: [PATCH 1/2] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20chore(deps):=20upgrade?= =?UTF-8?q?=20all=20dependencies=20to=20latest=20versions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ran npm-check-updates -u across the manifest. No major version bumps were available: pg and ws are both still on major 8 upstream, so this is the latest of everything, not a major-version migration. - pg ^8.20.0 -> ^8.22.0 (transitively pg-protocol 1.13.0 -> 1.15.0, pg-pool 3.13.0 -> 3.14.0, pg-connection-string 2.12.0 -> 2.14.0, pg-cloudflare 1.3.0 -> 1.4.0) - ws ^8.19.0 -> ^8.21.1 Clears both open Dependabot alerts, both against ws: - high GHSA-96hv-2xvq-fx4p memory exhaustion DoS (fixed in 8.21.0) - medium GHSA-58qx-3vcg-4xpx uninitialized memory disclosure (8.20.1) No source changes were needed. The only APIs this repo touches are WebSocketServer from ws and Pool/Pool.query from pg, both unchanged. npm audit now reports 0 vulnerabilities. --- package-lock.json | 48 +++++++++++++++++++++++------------------------ package.json | 4 ++-- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7d5bb2a..3bc7a1a 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,19 +9,19 @@ "version": "1.0.0", "license": "MIT", "dependencies": { - "pg": "^8.20.0", - "ws": "^8.19.0" + "pg": "^8.22.0", + "ws": "^8.21.1" } }, "node_modules/pg": { - "version": "8.20.0", - "resolved": "https://registry.npmjs.org/pg/-/pg-8.20.0.tgz", - "integrity": "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA==", + "version": "8.22.0", + "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz", + "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==", "license": "MIT", "dependencies": { - "pg-connection-string": "^2.12.0", - "pg-pool": "^3.13.0", - "pg-protocol": "^1.13.0", + "pg-connection-string": "^2.14.0", + "pg-pool": "^3.14.0", + "pg-protocol": "^1.15.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, @@ -29,7 +29,7 @@ "node": ">= 16.0.0" }, "optionalDependencies": { - "pg-cloudflare": "^1.3.0" + "pg-cloudflare": "^1.4.0" }, "peerDependencies": { "pg-native": ">=3.0.1" @@ -41,16 +41,16 @@ } }, "node_modules/pg-cloudflare": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.3.0.tgz", - "integrity": "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ==", + "version": "1.4.0", + "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz", + "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==", "license": "MIT", "optional": true }, "node_modules/pg-connection-string": { - "version": "2.12.0", - "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.12.0.tgz", - "integrity": "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ==", + "version": "2.14.0", + "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz", + "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==", "license": "MIT" }, "node_modules/pg-int8": { @@ -63,18 +63,18 @@ } }, "node_modules/pg-pool": { - "version": "3.13.0", - "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.13.0.tgz", - "integrity": "sha512-gB+R+Xud1gLFuRD/QgOIgGOBE2KCQPaPwkzBBGC9oG69pHTkhQeIuejVIk3/cnDyX39av2AxomQiyPT13WKHQA==", + "version": "3.14.0", + "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz", + "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==", "license": "MIT", "peerDependencies": { "pg": ">=8.0" } }, "node_modules/pg-protocol": { - "version": "1.13.0", - "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.13.0.tgz", - "integrity": "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w==", + "version": "1.15.0", + "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz", + "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==", "license": "MIT" }, "node_modules/pg-types": { @@ -151,9 +151,9 @@ } }, "node_modules/ws": { - "version": "8.19.0", - "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz", - "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==", + "version": "8.21.1", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz", + "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==", "license": "MIT", "engines": { "node": ">=10.0.0" diff --git a/package.json b/package.json index 65479f2..8d4dea7 100644 --- a/package.json +++ b/package.json @@ -8,7 +8,7 @@ "test": "node --test" }, "dependencies": { - "pg": "^8.20.0", - "ws": "^8.19.0" + "pg": "^8.22.0", + "ws": "^8.21.1" } } From 2dc6e46153a95975b2f6593070cab08f2da67fcc Mon Sep 17 00:00:00 2001 From: Luis Cosio Date: Sun, 19 Jul 2026 18:14:11 -0700 Subject: [PATCH 2/2] =?UTF-8?q?=E2=AC=86=EF=B8=8F=20chore:=20standardize?= =?UTF-8?q?=20on=20Node=2024?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Dockerfile: node:22-alpine -> node:24-alpine - package.json: add engines.node >=24 Verified: npm ci + npm test 25/25 pass, npm audit 0 vulns, docker build succeeds, running 24-alpine image serves /health -> {"status":"ok"} (HTTP 200). --- Dockerfile | 2 +- package.json | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 73a0200..2016724 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM node:22-alpine +FROM node:24-alpine WORKDIR /app COPY package.json package-lock.json ./ RUN npm ci --omit=dev diff --git a/package.json b/package.json index 8d4dea7..7ba556e 100644 --- a/package.json +++ b/package.json @@ -7,6 +7,9 @@ "start": "node server.js", "test": "node --test" }, + "engines": { + "node": ">=24" + }, "dependencies": { "pg": "^8.22.0", "ws": "^8.21.1"