Update several packages to the latest version and fix the subsequent lint violations#55
Merged
ar27111994 merged 10 commits intomainfrom Apr 16, 2026
Merged
Update several packages to the latest version and fix the subsequent lint violations#55ar27111994 merged 10 commits intomainfrom
ar27111994 merged 10 commits intomainfrom
Conversation
Bumps the dependencies group with 9 updates: | Package | From | To | | --- | --- | --- | | [dotenv](https://github.com/motdotla/dotenv) | `17.4.1` | `17.4.2` | | [@apify/actor-memory-expression](https://github.com/apify/apify-shared-js) | `0.1.10` | `0.1.11` | | [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js) | `9.39.4` | `10.0.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.5.2` | `25.6.0` | | [@types/supertest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/supertest) | `6.0.3` | `7.2.0` | | [eslint-plugin-sonarjs](https://github.com/SonarSource/SonarJS) | `3.0.7` | `4.0.2` | | [globals](https://github.com/sindresorhus/globals) | `17.4.0` | `17.5.0` | | [prettier](https://github.com/prettier/prettier) | `3.8.1` | `3.8.3` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.2` | Updates `dotenv` from 17.4.1 to 17.4.2 - [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md) - [Commits](motdotla/dotenv@v17.4.1...v17.4.2) Updates `@apify/actor-memory-expression` from 0.1.10 to 0.1.11 - [Release notes](https://github.com/apify/apify-shared-js/releases) - [Changelog](https://github.com/apify/apify-shared-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/apify/apify-shared-js/compare/@apify/actor-memory-expression@0.1.10...@apify/actor-memory-expression@0.1.11) Updates `@eslint/js` from 9.39.4 to 10.0.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/commits/v10.0.1/packages/js) Updates `@types/node` from 25.5.2 to 25.6.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@types/supertest` from 6.0.3 to 7.2.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/supertest) Updates `eslint-plugin-sonarjs` from 3.0.7 to 4.0.2 - [Release notes](https://github.com/SonarSource/SonarJS/releases) - [Commits](https://github.com/SonarSource/SonarJS/commits) Updates `globals` from 17.4.0 to 17.5.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.4.0...v17.5.0) Updates `prettier` from 3.8.1 to 3.8.3 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.1...3.8.3) Updates `typescript` from 5.9.3 to 6.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.2) --- updated-dependencies: - dependency-name: dotenv dependency-version: 17.4.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@apify/actor-memory-expression" dependency-version: 0.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: "@eslint/js" dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: "@types/node" dependency-version: 25.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: "@types/supertest" dependency-version: 7.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: eslint-plugin-sonarjs dependency-version: 4.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies - dependency-name: globals dependency-version: 17.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: prettier dependency-version: 3.8.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: typescript dependency-version: 6.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the repo’s dev dependency set and adjusts a few code paths to satisfy new/updated lint rules (primarily around useless assignments and preserving caught errors).
Changes:
- Bump multiple dev dependencies (ESLint stack, TypeScript, typings) and refresh
package-lock.json. - Remove a lint-triggering useless assignment in the forwarding payload size check.
- Preserve original errors when rethrowing in test harness/helpers via
Error(..., { cause }). - Clean up an unused ESLint disable in a unit test.
Reviewed changes
Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/unit/utils/common.test.js | Removes an unused lint suppression. |
| tests/setup/helpers/e2e-process-harness.js | Rethrows startup diagnostics while preserving the original failure as cause. |
| tests/setup/helpers/constant-discovery.js | Preserves the original discovery error as cause when rethrowing. |
| src/services/ForwardingService.js | Adjusts body size check to remove a useless initial assignment. |
| package.json | Updates dev dependency versions (ESLint stack, TypeScript, typings). |
| package-lock.json | Lockfile refresh to match updated dependency graph. |
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughUpdated Node engine minimum and devDependencies in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/services/ForwardingService.js (1)
272-288:⚠️ Potential issue | 🟠 MajorValidate
Content-Lengthbefore using it in the size guard.At Line 273, malformed
Content-Lengthparses toNaN; then Line 288 (bodySize > MAX_FORWARD_BODY) is false, so oversized payloads can bypass this defensive check. Fall back to computed body size when header parsing is invalid.Proposed fix
- let bodySize; - if (req.headers[HTTP_HEADERS.CONTENT_LENGTH]) { - bodySize = parseInt(String(req.headers[HTTP_HEADERS.CONTENT_LENGTH]), 10); - } else { + let bodySize; + const rawContentLength = req.headers[HTTP_HEADERS.CONTENT_LENGTH]; + const parsedContentLength = rawContentLength + ? Number.parseInt(String(rawContentLength), 10) + : Number.NaN; + + if (Number.isFinite(parsedContentLength) && parsedContentLength >= 0) { + bodySize = parsedContentLength; + } else { if (Buffer.isBuffer(req.body)) { bodySize = req.body.length; } else if (typeof req.body === "string") { bodySize = Buffer.byteLength(req.body); } else { try { bodySize = Buffer.byteLength(JSON.stringify(req.body)); } catch { bodySize = 0; } } }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/services/ForwardingService.js` around lines 272 - 288, The Content-Length header parsing in ForwardingService (the req.headers[HTTP_HEADERS.CONTENT_LENGTH] branch setting bodySize) can produce NaN and bypass the MAX_FORWARD_BODY check; update the logic that assigns bodySize from Content-Length to validate the parsed value (Number.isFinite or isNaN check) and if invalid fall back to the computed sizes (the existing Buffer.isBuffer/typeof string/JSON.stringify path) before comparing against MAX_FORWARD_BODY so oversized payloads cannot bypass the guard; keep references to req.headers[HTTP_HEADERS_CONTENT_LENGTH], the bodySize variable, and the MAX_FORWARD_BODY comparison in your fix.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@src/services/ForwardingService.js`:
- Around line 272-288: The Content-Length header parsing in ForwardingService
(the req.headers[HTTP_HEADERS.CONTENT_LENGTH] branch setting bodySize) can
produce NaN and bypass the MAX_FORWARD_BODY check; update the logic that assigns
bodySize from Content-Length to validate the parsed value (Number.isFinite or
isNaN check) and if invalid fall back to the computed sizes (the existing
Buffer.isBuffer/typeof string/JSON.stringify path) before comparing against
MAX_FORWARD_BODY so oversized payloads cannot bypass the guard; keep references
to req.headers[HTTP_HEADERS_CONTENT_LENGTH], the bodySize variable, and the
MAX_FORWARD_BODY comparison in your fix.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7eeb48e2-fd7b-44b4-885f-d9bf794848b9
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (5)
package.jsonsrc/services/ForwardingService.jstests/setup/helpers/constant-discovery.jstests/setup/helpers/e2e-process-harness.jstests/unit/utils/common.test.js
💤 Files with no reviewable changes (1)
- tests/unit/utils/common.test.js
ar27111994
changed the title
Owner
Author
|
@copilot apply changes based on the comments in this thread |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
Done in commits a9336d0 and b38af5d:
|
…gh parameter tampering' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
src/services/ForwardingService.js (1)
274-280:⚠️ Potential issue | 🟠 MajorHarden
Content-Lengthparsing before trusting it.Line 275 can be a
string[];String(req.headers[...])turns that into a comma-joined value, andparseInt()will still accept the leading digits from values like"1,999999"or"1abc". That means malformed or duplicatedContent-Lengthheaders can bypass the fallback body measurement and weaken the oversized-payload guard.Suggested fix
- const parsedContentLength = parseInt( - String(req.headers[HTTP_HEADERS.CONTENT_LENGTH] ?? ""), - 10, - ); + const rawContentLength = req.headers[HTTP_HEADERS.CONTENT_LENGTH]; + const parsedContentLength = + typeof rawContentLength === "string" && /^\d+$/.test(rawContentLength) + ? Number(rawContentLength) + : Number.NaN;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/services/ForwardingService.js` around lines 274 - 280, parsedContentLength is currently derived from String(req.headers[HTTP_HEADERS.CONTENT_LENGTH]) which can turn string[] and malformed values like "1,999" or "1abc" into a number; tighten parsing by first reading req.headers[HTTP_HEADERS.CONTENT_LENGTH] into a local (e.g. rawCL), reject arrays (Array.isArray(rawCL) -> treat as invalid), verify rawCL matches /^\d+$/ before calling parseInt, and only set bodySize = parsedContentLength when the regex passes and Number.isFinite(parsedContentLength); otherwise fall back to measuring the actual request body length as before. Ensure you update the checks around parsedContentLength and Number.isFinite to use the new validated value.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@tests/unit/services/forwarding_service.test.js`:
- Around line 27-50: The test imports constants (HTTP_STATUS_MESSAGES,
MIME_TYPES from src/consts/http.js) before calling setupCommonMocks, which
causes the real module to be loaded before mocks are applied; update the test so
that setupCommonMocks({...}) is invoked before any imports of source
modules/constants (including HTTP_STATUS_MESSAGES, MIME_TYPES and
ForwardingService) so mocks (consts: true) take effect — move the static imports
of HTTP_STATUS_MESSAGES and MIME_TYPES (and any other src/consts/* imports)
below the await setupCommonMocks(...) call and then import ForwardingService and
related consts after that.
---
Duplicate comments:
In `@src/services/ForwardingService.js`:
- Around line 274-280: parsedContentLength is currently derived from
String(req.headers[HTTP_HEADERS.CONTENT_LENGTH]) which can turn string[] and
malformed values like "1,999" or "1abc" into a number; tighten parsing by first
reading req.headers[HTTP_HEADERS.CONTENT_LENGTH] into a local (e.g. rawCL),
reject arrays (Array.isArray(rawCL) -> treat as invalid), verify rawCL matches
/^\d+$/ before calling parseInt, and only set bodySize = parsedContentLength
when the regex passes and Number.isFinite(parsedContentLength); otherwise fall
back to measuring the actual request body length as before. Ensure you update
the checks around parsedContentLength and Number.isFinite to use the new
validated value.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 02754c7a-758e-442e-9935-da54e1f2c476
📒 Files selected for processing (2)
src/services/ForwardingService.jstests/unit/services/forwarding_service.test.js
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR updates several packages to the latest version and fixes the subsequent lint violations introduced in forwarding and test helper paths, so the branch passes the project lint gate cleanly.
Summary of changes:
Issue fixed:
Type of change
If you selected "Breaking change", please describe the impact and migration path below:
Checklist
Summary by CodeRabbit
Chores
Bug Fixes
Tests