Skip to content

v0.125.1 — Share links from configuration; dependency security

Two follow-ups to the CodeQL backlog (v0.122.1 - v0.124.2). Cut as v0.124.3; v0.125.0 (Procedural maps: Outdoor templates) merged first, so it ships as v0.125.1: the share links it left alone, and the Dependabot alerts code scanning doesn't cover (100 open: 1 critical, 59 high, 36 medium, 4 low).

  • [x] Share and invite links (character invites, campaign invites, the campaign-added email) are built from FRONTEND_URL / APP_BASE_URL, never from the request's Host header.
    • Note: they fell back to req.protocol + "://" + req.get("host") when neither variable was set, so a request with a forged Host got an invite link (and sent a player an email) to that host. config/frontendUrl.ts's frontendBaseUrl() falls back to this machine's dev client instead, as the sign-in redirect and the wiki already do; every hosted environment sets FRONTEND_URL. frontendUrl.test.ts fails on any route that reads the Host header.
  • [x] Dependabot: the critical alert and the high alerts that reach production (server runtime or the shipped web bundle) fixed by dependency bumps; the rest triaged with the reason.
    • Note: 192 alerts were open (1 critical, 110 high, 71 medium, 10 low). Fixed by bumps: proxy-addr 2.0.8 (the critical), nodemailer 10.0.6 (Node 20+, which we exceed, and TLS checks on remote attachments, which we don't use), sharp 0.35.5 (its bundled libvips; @kenjura/ursa's and @huggingface/transformers' copies by override too), drizzle-orm 0.45.2, adm-zip 0.6.1, dompurify 3.4.16, react-router-dom 7.18, vitest 4.1.11, and, as pnpm.overrides scoped to the vulnerable range of each line, the transitive ones (engine.io, socket.io-parser, ws, compression, body-parser, path-to-regexp, qs, form-data, js-yaml, lodash, minimatch, brace-expansion, nanoid, rollup, postcss and more). The SAM2 service: Pillow 12.3.0 (its fromarray call drops the deprecated mode).
    • Left open, with the reason:
      • xlsx 0.18.5 (high): no fixed version on npm; SheetJS publishes fixes only at cdn.sheetjs.com. It parses a user's own spreadsheet in their browser (character sheet import). Moving to the CDN tarball is a dependency-source decision for the owner.
      • toml 3.0.0 (high), markdown-it 12 / linkify-it 3 (high and medium), uuid 9 (medium): all inside @kenjura/ursa (the wiki renderer, via mdx-bundler and remark-mdx-frontmatter), each a major version behind; the fix is an ursa release.
      • vite 5.4.21 and its esbuild 0.18 / 0.21 (medium): apps/web's dev server and build only, not the shipped bundle; moving the app to Vite 6+ is its own task.
      • file-type 16, sprintf-js, cookie 0.5, esbuild 0.27 (medium and low): transitive in build and help tooling, with no fix in their major line.