fix(deps): refresh vulnerable API and web packages by SimonFair · Pull Request #2098 · unraid/api

SimonFair · 2026-09-29T12:07:27Z

Refreshes the existing dependency update for newly published advisories, reducing the production audit from 30 findings to three while preserving the existing audit policy.

Updates the affected API/Web/UI packages and transitive resolutions, including GraphQL Tools utilities 12.0.1, Fastify 5.12.5, NestJS Fastify adapter 11.2.4, DOMPurify 3.4.16, Vue 3.5.42, axios, gRPC, basic-ftp, source-map-js and fast-copy. Root and workspace overrides stay consistent. Removes unused API load-files dependency; braces still arrives through NestJS.

The Vue update exposes a dialog class check that assumed string input. Normalizing Vue class values preserves fullscreen animations for strings, arrays and objects; six regressions cover reactive updates. Web test fixtures now use a stable timezone and dispose component/store scopes.

Validation at commit 176ee2cb634e7106b1475d920568df44a1ec343b: Node 22 frozen installation, API/UI/Web type checks and builds pass. Current CI run 37464232518 passes the full Linux test suites, API/Web/UI builds and final TXZ pkgtools validation. CodeQL, Codecov project/patch and CodeRabbit pass. Audit Dependencies is advisory and retains the three findings below.

The exact CI TXZ (SHA-256 4d74dee6f4b3433e0c0a42a9bf0e60b9390901ac521bff277f78cd55dfa4dd60) passed managed Unraid 7.3.2 smoke testing: upgrade and reinstall preserve all 150 component files byte-for-byte; obsolete component cleanup, API restart, temporary VIEWER key creation, authenticated GraphQL through the API socket and nginx, internal CLI report, and HTTP component bytes pass. The managed reservation was restored and released. This smoke test does not cover full Connect cloud callbacks or browser visual E2E.

Residual audit findings remain visible: http-cache-semantics, braces and sprintf-js (two high, one moderate) currently have no patched versions. Source inspection found no enabled Got HTTP cache and static global-agent log formats; this is limited evidence, not a claim that those advisories are fixed or unreachable. No suppressions or lower thresholds were added.

Linear issue: CLD-1208

coderabbitai · 2026-09-29T12:07:36Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 99db7988-8f48-4e7d-acd7-dec960cbf875

📥 Commits

Reviewing files that changed from the base of the PR and between ad700c4 and 176ee2c.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (10)

api/package.json
package.json
packages/unraid-shared/package.json
pnpm-workspace.yaml
unraid-ui/package.json
unraid-ui/src/components/ui/dialog/DialogContent.test.ts
unraid-ui/src/components/ui/dialog/DialogContent.vue
web/__test__/components/KeyActions.test.ts
web/__test__/components/Onboarding/OnboardingCoreSettingsStep.test.ts
web/package.json

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The pull request updates workspace dependency overrides and package versions. It changes dialog animation selection to use normalized class input and adjusts UI test setup for cleanup and timezone consistency.

Changes

Dependency Updates

Layer / File(s)	Summary
Workspace dependency overrides `package.json`, `pnpm-workspace.yaml`	The root package and workspace configuration update dependency pins and version ranges.
Package dependency declarations `api/package.json`, `packages/unraid-api-plugin-connect/package.json`, `packages/unraid-shared/package.json`	The API and shared package manifests update GraphQL tools, Fastify, and undici declarations.
UI dependency declarations `unraid-ui/package.json`, `web/package.json`	The UI and web manifests update Vue, Vue compiler, and DOMPurify versions.

Dialog Animation Selection

Layer / File(s)	Summary
Fullscreen detection and animation tests `unraid-ui/src/components/ui/dialog/DialogContent.vue`, `unraid-ui/src/components/ui/dialog/DialogContent.test.ts`	DialogContent checks the normalized class for the exact `min-h-screen` token and selects the corresponding animation classes. Tests cover class variants and reactive updates.

Web Test Setup

Layer / File(s)	Summary
Test lifecycle and environment setup `web/__test__/components/KeyActions.test.ts`, `web/__test__/components/Onboarding/OnboardingCoreSettingsStep.test.ts`	KeyActions tests dispose Pinia and automatically unmount components. Onboarding tests automatically unmount components, restore mocks, and set the timezone to UTC.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 176ee

This change refreshes dependency versions and adjusts a dialog animation check and some test setup. No concrete merge-blocking issue was identified.

Architecture Summary

Architecture risk: 🔵 Low · up to ad700

The change affects 5 systems.

Changed systems: api, package.json, packages/unraid-api-plugin-connect, packages/unraid-shared, pnpm-workspace.yaml

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

observed — api (service) was modified; 1 changed file maps to changed impact.
observed — package.json (service) was modified; 1 changed file maps to changed impact.
observed — packages/unraid-api-plugin-connect (library) was modified; 1 changed file maps to changed impact.
observed — packages/unraid-shared (library) was modified; 1 changed file maps to changed impact.

Before / after behavior

observed — Modified behavior in api/package.json: Updated the undici dependency version from 7.29.0 to 7.29.1.
observed — Modified behavior in package.json: The brace-expansion override ranges now pin to 1.1.19 for versions below 1.1.19 and 5.0.12 for versions from 3.0.0 up to (but excluding) 5.0.13, replacing the prior thresholds and pins. The fast-uri pin changes from 3.1.6 to 3.1.8.
observed — Modified behavior in package.json: The ip-address override changes from applying only to versions >=10.0.0 <10.3.1 at 10.3.1 to an unconditional 10.7.1 pin. The brace-expansion range from >=2.0.0 <2.1.4 at 2.1.4 is replaced with >=2.0.0 <2.1.8 at 2.1.7.
observed — Modified behavior in packages/unraid-api-plugin-connect/package.json: The undici version in devDependencies changed from 7.29.0 to 7.29.1.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the dependency refresh and its security focus, which match the pull request’s main changes.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit checks the dialog's class,
And watches fullscreen slides pass.
New versions hop into place,
While tests clean up with care and grace.
UTC keeps time in a steady embrace.}

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-29T15:11:47Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.49%. Comparing base (89b1395) to head (176ee2c).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2098      +/-   ##
==========================================
+ Coverage   53.43%   53.49%   +0.05%     
==========================================
  Files        1044     1044              
  Lines       72705    72706       +1     
  Branches     8422     8422              
==========================================
+ Hits        38852    38896      +44     
+ Misses      33726    33683      -43     
  Partials      127      127

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-09-29T15:12:23Z

This plugin has been deployed to Cloudflare R2 and is available for testing.
Download it at this URL:

https://preview.dl.unraid.net/unraid-api/tag/PR2098/dynamix.unraid.net.plg

github-actions · 2026-10-06T12:36:42Z

🚀 Storybook has been deployed to staging: https://unraid-ui-storybook-staging.unraid-workers.workers.dev

github-actions · 2026-10-06T14:26:56Z

🔄 PR Merged - Plugin Redirected to Staging

This PR has been merged and the preview plugin has been updated to redirect to the staging version.

For users testing this PR:

Your plugin will automatically update to the staging version on the next update check
The staging version includes all merged changes from this PR
No manual intervention required

Staging URL:

https://preview.dl.unraid.net/unraid-api/dynamix.unraid.net.plg

Thank you for testing! 🚀

## Summary External callback actions require a short-lived, one-time nonce so cross-tab and delayed activation callbacks can be validated before they execute. Related to OS-983. Dependency refresh #2098 is merged. ## Resolution Use `@unraid/shared-callbacks` 3.4.0 and its client `createCallback` factory. Pass the nonce through the dedicated `send` and `generateUrl` arguments and validate the returned encrypted `payload.nonce`. The sender remains a return URL; its query parameters do not supply nonce authority. Nonces remain in localStorage for 30 minutes to support callbacks returning in a separate tab. Activation links are generated when opened, and duplicate callback processing is ignored. ## Reviewer Considerations The callback responder must echo the receiver-issued nonce unchanged in its reply. Missing, expired, unknown, malformed, and reused nonces are rejected on URL callbacks. Direct in-process calls retain the existing relative-sender compatibility. Live Account-to-WebGUI behavior has not been tested in this update. ## Verification - 78 callback, callback-helper, and purchase tests passed, including an encrypted URL round trip with the published callback package. - Targeted ESLint, Prettier, GraphQL code generation, and `git diff --check` passed. - Full web type-check remains blocked: the original and updated PR code produce the same 134 TypeScript diagnostics, with none in the callback store or its tests. - Web build and onboarding component tests remain blocked by the UI dependency build: `unplugin-dts` cannot resolve `@vue/language-core`, leaving `@unraid/ui` without build output. --------- Co-authored-by: Eli Bosley <eli@bosley.dev>

🤖 I have created a release *beep* *boop* --- ## [4.37.6](v4.37.5...v4.37.6) (2026-10-20) ### Bug Fixes * **api:** stop temperature metrics from spinning up array disks ([#2091](#2091)) ([b15af83](b15af83)) * **callback:** validate callback requests ([#2097](#2097)) ([1bda4d2](1bda4d2)) * **connect:** avoid restarting active static remote access ([#2110](#2110)) ([d19a6f4](d19a6f4)) * **deps:** refresh vulnerable API and web packages ([#2098](#2098)) ([64eac12](64eac12)) * **plugin:** bind component cleanup to the exact package manifest ([#2107](#2107)) ([89b1395](89b1395)) * **web:** align mobile header identity and update actions ([#2111](#2111)) ([6582cc1](6582cc1)) * **web:** align registration license action buttons ([#2101](#2101)) ([b638d29](b638d29)) * **web:** polish combined header on mobile and desktop ([#2109](#2109)) ([64f1e81](64f1e81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore(deps): refresh resolved packages

efad2b6

chore(deps): update resolved packages

ad700c4

coderabbitai Bot requested a review from Eli Bosley (elibosley) September 30, 2026 13:08

coderabbitai Bot approved these changes Sep 30, 2026

View reviewed changes

This was referenced Sep 30, 2026

fix(auth): limit repeated authorization requests #2094

Open

fix(graphql): filter schema metadata requests #2095

Open

fix(settings): omit internal provider values #2096

Open

fix(callback): validate callback requests #2097

Merged

SimonFair added this pull request to stack #2099 September 30, 2026 16:13

Eli Bosley (elibosley) added 3 commits October 6, 2026 11:07

Merge remote-tracking branch 'origin/main' into codex/dependency-refresh

9461706

fix(deps): update packages with published security fixes

c0a45ac

fix(web): support Vue class inputs and isolate component tests

176ee2c

Eli Bosley (elibosley) changed the title ~~chore(deps): refresh resolved packages~~ fix(deps): refresh vulnerable API and web packages Oct 6, 2026

Eli Bosley (elibosley) merged commit 64eac12 into main Oct 6, 2026

Eli Bosley (elibosley) deleted the codex/dependency-refresh branch October 6, 2026 14:26

github-actions Bot mentioned this pull request Oct 6, 2026

chore(main): release 4.37.6 #2102

Merged

Navigation Menu

Repository navigation

fix(deps): refresh vulnerable API and web packages - #2098

fix(deps): refresh vulnerable API and web packages#2098
Eli Bosley (elibosley) merged 5 commits into
mainfrom
codex/dependency-refresh

SimonFair commented Sep 29, 2026 •

edited by elibosley

Loading

Uh oh!

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Sep 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 29, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

SimonFair commented Sep 29, 2026 • edited by elibosley Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Architecture Summary

Uh oh!

codecov Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Sep 29, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026

Uh oh!

github-actions Bot commented Oct 6, 2026

🔄 PR Merged - Plugin Redirected to Staging

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SimonFair commented Sep 29, 2026 •

edited by elibosley

Loading

coderabbitai Bot commented Sep 29, 2026 •

edited

Loading

codecov Bot commented Sep 29, 2026 •

edited

Loading