[pull] main from hoppscotch:main

.env.example

@@ -14,6 +14,12 @@ DATA_ENCRYPTION_KEY=data encryption key with 32 char
 #   bundle names like `app://{bundle-name}/`
 WHITELISTED_ORIGINS=http://localhost:3170,http://localhost:3000,http://localhost:3100,app://localhost_3200,app://hoppscotch
 
+# Optional: Default proxy URL offered to clients when proxying is enabled.
+# Clients control whether requests are proxied via the in-app toggle; this only
+# sets which URL they default to. Remove the variable to configure it solely
+# from the admin dashboard.
+PROXY_APP_URL="https://proxy.hoppscotch.io"
+
 # If true, the client’s IP address is understood as the left-most entry in the X-Forwarded-For header
 TRUST_PROXY=false
 

package.json

@@ -5,7 +5,7 @@
   "author": "Hoppscotch (support@hoppscotch.io)",
   "private": true,
   "license": "MIT",
-  "packageManager": "pnpm@10.33.2",
+  "packageManager": "pnpm@10.33.4",
   "scripts": {
     "preinstall": "npx only-allow pnpm",
     "prepare": "husky",
@@ -35,19 +35,19 @@
   },
   "pnpm": {
     "overrides": {
-      "@nestjs-modules/mailer>mjml": "5.0.0-alpha.4",
       "@xmldom/xmldom": "0.8.13",
       "apiconnect-wsdl": "2.0.36",
       "body-parser": "2.2.1",
       "cross-spawn": "7.0.6",
       "execa@<2.0.0": "2.0.0",
+      "fast-uri@<=3.1.1": "3.1.2",
       "form-data": "4.0.4",
       "glob@>=11.0.0 <11.1.0": "11.1.0",
       "lodash": "4.18.1",
       "minimatch@>=4.0.0 <4.2.5": "4.2.5",
       "serialize-javascript@<7.0.3": "7.0.3",
       "subscriptions-transport-ws>ws": "7.5.10",
-      "vue": "3.5.33",
+      "vue": "3.5.34",
       "ws": "8.17.1"
     },
     "onlyBuiltDependencies": [

packages/hoppscotch-agent/package.json

@@ -24,7 +24,7 @@
     "axios": "1.15.2",
     "fp-ts": "2.16.11",
     "lodash-es": "4.18.1",
-    "vue": "3.5.33"
+    "vue": "3.5.34"
   },
   "devDependencies": {
     "@iconify-json/lucide": "1.2.104",

packages/hoppscotch-backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hoppscotch-backend",
-  "version": "2026.4.1",
+  "version": "2026.5.0",
   "description": "",
   "author": "",
   "private": true,
@@ -31,19 +31,19 @@
     "do-test": "pnpm run test"
   },
   "dependencies": {
-    "@apollo/server": "5.5.0",
+    "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
-    "@nestjs-modules/mailer": "2.3.4",
-    "@nestjs/apollo": "13.3.0",
-    "@nestjs/common": "11.1.19",
+    "@nestjs-modules/mailer": "2.3.5",
+    "@nestjs/apollo": "13.4.0",
+    "@nestjs/common": "11.1.21",
     "@nestjs/config": "4.0.4",
-    "@nestjs/core": "11.1.19",
-    "@nestjs/graphql": "13.3.0",
+    "@nestjs/core": "11.1.21",
+    "@nestjs/graphql": "13.4.0",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/passport": "11.0.0",
-    "@nestjs/platform-express": "11.1.19",
+    "@nestjs/platform-express": "11.1.21",
     "@nestjs/schedule": "6.1.3",
-    "@nestjs/swagger": "11.4.2",
+    "@nestjs/swagger": "11.4.3",
     "@nestjs/terminus": "11.1.1",
     "@nestjs/throttler": "6.5.0",
     "@prisma/adapter-pg": "7.8.0",
@@ -57,7 +57,7 @@
     "dotenv": "17.4.2",
     "express": "5.2.1",
     "fp-ts": "2.16.11",
-    "graphql": "16.13.2",
+    "graphql": "16.14.0",
     "graphql-query-complexity": "1.1.0",
     "graphql-redis-subscriptions": "2.7.0",
     "graphql-subscriptions": "3.0.0",
@@ -71,8 +71,8 @@
     "passport-jwt": "4.0.1",
     "passport-local": "1.0.0",
     "passport-microsoft": "2.1.0",
-    "pg": "8.20.0",
-    "posthog-node": "5.30.6",
+    "pg": "8.21.0",
+    "posthog-node": "5.34.6",
     "prisma": "7.8.0",
     "reflect-metadata": "0.2.2",
     "rimraf": "6.1.3",
@@ -83,32 +83,32 @@
     "@eslint/js": "10.0.1",
     "@nestjs/cli": "11.0.21",
     "@nestjs/schematics": "11.1.0",
-    "@nestjs/testing": "11.1.19",
+    "@nestjs/testing": "11.1.21",
     "@relmify/jest-fp-ts": "2.1.1",
     "@types/bcrypt": "6.0.0",
     "@types/cookie-parser": "1.4.10",
     "@types/express": "5.0.6",
     "@types/jest": "30.0.0",
-    "@types/node": "25.6.0",
+    "@types/node": "25.9.0",
     "@types/nodemailer": "8.0.0",
     "@types/passport-github2": "1.2.9",
     "@types/passport-google-oauth20": "2.0.17",
     "@types/passport-jwt": "4.0.1",
     "@types/passport-microsoft": "2.1.1",
     "@types/supertest": "7.2.0",
-    "@typescript-eslint/eslint-plugin": "8.59.1",
-    "@typescript-eslint/parser": "8.59.1",
+    "@typescript-eslint/eslint-plugin": "8.59.4",
+    "@typescript-eslint/parser": "8.59.4",
     "cross-env": "10.1.0",
-    "eslint": "10.2.1",
+    "eslint": "10.4.0",
     "eslint-config-prettier": "10.1.8",
     "eslint-plugin-prettier": "5.5.5",
-    "globals": "17.5.0",
-    "jest": "30.3.0",
+    "globals": "17.6.0",
+    "jest": "30.4.2",
     "jest-mock-extended": "4.0.1",
     "prettier": "3.8.3",
     "source-map-support": "0.5.21",
     "supertest": "7.2.2",
-    "ts-jest": "29.4.9",
+    "ts-jest": "29.4.10",
     "ts-loader": "9.5.7",
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",

packages/hoppscotch-backend/src/access-token/dto/create-access-token.dto.ts

@@ -1,5 +1,12 @@
+import { IsNotEmpty, IsNumber, IsString, ValidateIf } from 'class-validator';
+
 // Inputs to create a new PAT
 export class CreateAccessTokenDto {
+  @IsString()
+  @IsNotEmpty()
   label: string;
+
+  @ValidateIf((o) => o.expiryInDays !== null)
+  @IsNumber()
   expiryInDays: number | null;
 }

packages/hoppscotch-backend/src/admin/infra.resolver.ts

@@ -34,6 +34,7 @@ import {
 } from 'src/infra-config/input-args';
 import { InfraConfigEnum } from 'src/types/InfraConfig';
 import { ServiceStatus } from 'src/infra-config/helper';
+import { FetchAllTeamsV2Args, FetchAllUsersV2Args } from './input-types.args';
 
 @UseGuards(GqlThrottlerGuard)
 @Resolver(() => Infra)
@@ -92,19 +93,11 @@ export class InfraResolver {
     description: 'Returns a list of all the users in infra',
   })
   @UseGuards(GqlAuthGuard, GqlAdminGuard)
-  async allUsersV2(
-    @Args({
-      name: 'searchString',
-      nullable: true,
-      description: 'Search on users displayName or email',
-    })
-    searchString: string,
-    @Args() paginationOption: OffsetPaginationArgs,
-  ): Promise<AuthUser[]> {
-    const users = await this.adminService.fetchUsersV2(
-      searchString,
-      paginationOption,
-    );
+  async allUsersV2(@Args() args: FetchAllUsersV2Args): Promise<AuthUser[]> {
+    const users = await this.adminService.fetchUsersV2(args.searchString, {
+      skip: args.skip,
+      take: args.take,
+    });
     return users;
   }
 
@@ -130,19 +123,11 @@ export class InfraResolver {
   @ResolveField(() => [Team], {
     description: 'Returns a list of all the teams in the infra',
   })
-  async allTeamsV2(
-    @Args({
-      name: 'searchString',
-      nullable: true,
-      description: 'Search on team name or ID',
-    })
-    searchString: string,
-    @Args() paginationOption: OffsetPaginationArgs,
-  ): Promise<Team[]> {
-    const teams = await this.adminService.fetchAllTeamsV2(
-      searchString,
-      paginationOption,
-    );
+  async allTeamsV2(@Args() args: FetchAllTeamsV2Args): Promise<Team[]> {
+    const teams = await this.adminService.fetchAllTeamsV2(args.searchString, {
+      skip: args.skip,
+      take: args.take,
+    });
     return teams;
   }
 

packages/hoppscotch-backend/src/admin/input-types.args.ts

@@ -1,19 +1,51 @@
 import { Field, ID, ArgsType } from '@nestjs/graphql';
 import { TeamAccessRole } from '../team/team.model';
+import { IsEnum, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+import { OffsetPaginationArgs } from 'src/types/input-types.args';
+
+@ArgsType()
+export class FetchAllUsersV2Args extends OffsetPaginationArgs {
+  @Field({
+    name: 'searchString',
+    nullable: true,
+    description: 'Search on users displayName or email',
+  })
+  @IsString()
+  @IsOptional()
+  searchString: string;
+}
+
+@ArgsType()
+export class FetchAllTeamsV2Args extends OffsetPaginationArgs {
+  @Field({
+    name: 'searchString',
+    nullable: true,
+    description: 'Search on team name or ID',
+  })
+  @IsString()
+  @IsOptional()
+  searchString: string;
+}
 
 @ArgsType()
 export class ChangeUserRoleInTeamArgs {
+  @IsString()
+  @IsNotEmpty()
   @Field(() => ID, {
     name: 'userUID',
     description: 'users UID',
   })
   userUID: string;
+
+  @IsString()
+  @IsNotEmpty()
   @Field(() => ID, {
     name: 'teamID',
     description: 'team ID',
   })
   teamID: string;
 
+  @IsEnum(TeamAccessRole)
   @Field(() => TeamAccessRole, {
     name: 'newRole',
     description: 'updated team role',
@@ -23,18 +55,23 @@ export class ChangeUserRoleInTeamArgs {
 
 @ArgsType()
 export class AddUserToTeamArgs {
+  @IsString()
+  @IsNotEmpty()
   @Field(() => ID, {
     name: 'teamID',
     description: 'team ID',
   })
   teamID: string;
 
+  @IsEnum(TeamAccessRole)
   @Field(() => TeamAccessRole, {
     name: 'role',
     description: 'The role of the user to add in the team',
   })
   role: TeamAccessRole;
 
+  @IsString()
+  @IsNotEmpty()
   @Field({
     name: 'userEmail',
     description: 'Email of the user to add to team',

packages/hoppscotch-backend/src/auth/dto/signin-magic.dto.ts

@@ -1,4 +1,7 @@
+import { IsEmail } from 'class-validator';
+
 // Inputs to initiate Magic-Link auth flow
 export class SignInMagicDto {
+  @IsEmail()
   email: string;
 }

packages/hoppscotch-backend/src/auth/dto/verify-magic.dto.ts

@@ -1,5 +1,12 @@
+import { IsNotEmpty, IsString } from 'class-validator';
+
 // Inputs to verify and sign a user in via magic-link
 export class VerifyMagicDto {
+  @IsString()
+  @IsNotEmpty()
   deviceIdentifier: string;
+
+  @IsString()
+  @IsNotEmpty()
   token: string;
 }

packages/hoppscotch-backend/src/infra-config/dto/onboarding.dto.ts

@@ -1,6 +1,6 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 import { Expose } from 'class-transformer';
-import { IsOptional, IsString } from 'class-validator';
+import { IsNotEmpty, IsOptional, IsString } from 'class-validator';
 import { InfraConfigEnum } from 'src/types/InfraConfig';
 
 export class GetOnboardingStatusResponse {
@@ -15,6 +15,7 @@ export class GetOnboardingStatusResponse {
 export class SaveOnboardingConfigRequest {
   @ApiProperty()
   @IsString()
+  @IsNotEmpty()
   [InfraConfigEnum.VITE_ALLOWED_AUTH_PROVIDERS]: string;
 
   @ApiPropertyOptional()
@@ -84,6 +85,7 @@ export class SaveOnboardingConfigRequest {
 
   @ApiPropertyOptional()
   @IsOptional()
+  @IsString()
   [InfraConfigEnum.MAILER_SMTP_URL]: string;
 
   @ApiPropertyOptional()
@@ -137,7 +139,6 @@ export class SaveOnboardingConfigRequest {
   [InfraConfigEnum.MAILER_SMTP_OAUTH2_REFRESH_TOKEN]: string;
   @ApiPropertyOptional()
   @IsOptional()
-  @IsString()
   [InfraConfigEnum.MAILER_SMTP_OAUTH2_ACCESS_URL]: string;
 }