Skip to content

Fix various dependabot alerts #2063

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 10 commits into from
May 19, 2025
Merged

Fix various dependabot alerts #2063

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
aa29555
Upgrade posthog-node to clear axios vulns
ericallam May 15, 2025
9ca8e18
Upgrade @slack/web-api to use a secure version of axios
ericallam May 15, 2025
7c02423
Update parse-duration to fix security vulns
ericallam May 15, 2025
cbc52ba
Mitigate against the ws DoS vuln
ericallam May 15, 2025
cc351a8
Upgrade body-parser to 1.20.3 in the webapp
ericallam May 15, 2025
99da059
Upgrade react-use to 17.5.1 to remove the fast-loops transitive dep
ericallam May 15, 2025
dada30f
Remove unused babel dev deps and config file that's no longer used
ericallam May 15, 2025
75105ba
Upgrade prismjs to 1.30.0 and bundle parse-duration now
ericallam May 15, 2025
9aa42d5
upgrade express to 4.20.0 to fix issue with XSS when redirecting
ericallam May 15, 2025
a874299
Upgrade @conform/zod to 0.9.2
ericallam May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions apps/webapp/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
"@remix-run/serve": "2.1.0",
"@remix-run/server-runtime": "2.1.0",
"@remix-run/v1-meta": "^0.1.3",
"@slack/web-api": "^6.8.1",
"@slack/web-api": "7.9.1",
"@socket.io/redis-adapter": "^8.3.0",
"@splinetool/react-spline": "^2.2.6",
"@tabler/icons-react": "^2.39.0",
Expand Down Expand Up @@ -146,10 +146,10 @@
"non.geist": "^1.0.2",
"ohash": "^1.1.3",
"openai": "^4.33.1",
"parse-duration": "^1.1.0",
"parse-duration": "^2.1.0",
"p-limit": "^6.2.0",
"posthog-js": "^1.93.3",
"posthog-node": "^3.1.3",
"posthog-node": "4.17.1",
"prism-react-renderer": "^2.3.1",
"prismjs": "^1.29.0",
"prom-client": "^15.1.0",
Expand Down
4 changes: 4 additions & 0 deletions apps/webapp/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,10 @@ if (process.env.HTTP_SERVER_DISABLED !== "true") {
});

server.keepAliveTimeout = 65 * 1000;
// Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
// by not allowing 2000+ headers to be sent and causing a DoS
// headers will instead be limited by the maxHeaderSize
server.maxHeadersCount = 0;
Comment on lines +132 to +135
Copy link
Contributor

@coderabbitai coderabbitai bot May 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Verify the intended behavior of setting maxHeadersCount = 0

Setting maxHeadersCount = 0 in Node.js HTTP server typically means "unlimited" or "no limit" on the number of headers, which seems contradictory to the stated goal of preventing DoS attacks from 2000+ headers.

In standard Node.js behavior:

  • Default value is 2000
  • Setting to 0 means "unlimited headers"

This configuration might not achieve the intended security mitigation unless there's additional context about how your specific Node.js environment interprets this value.

Please verify the expected behavior with this script:

🏁 Script executed:

#!/bin/bash
# Check Node.js documentation for maxHeadersCount behavior

# Find Node.js version used in the project
node -v

# Search for relevant information in Node.js documentation
curl -s https://nodejs.org/api/http.html | grep -A 10 "maxHeadersCount"

# Look for other HTTP header limit settings in the codebase
grep -r "maxHeaderSize\|headersTimeout" --include="*.ts" --include="*.js" .

Length of output: 6692

Adjust maxHeadersCount to enforce a header-count limit

The Node.js docs confirm that server.maxHeadersCount = 0 actually disables the header-count limit (default is 2000), so this override makes your server accept unlimited headers rather than capping them. To mitigate a DoS via excessive headers you should either:

• Remove the override entirely and rely on the default (2000)
• Or set a lower, positive limit (e.g. 1000) that fits your threat model

Please update in apps/webapp/server.ts (lines 132–135):

- // Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
- // by not allowing 2000+ headers to be sent and causing a DoS
- // headers will instead be limited by the maxHeaderSize
- server.maxHeadersCount = 0;
+ // Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
+ // by capping the number of headers; rely on header-size limits for payload size
+ // Remove override to use default (2000) or choose a custom cap:
+ server.maxHeadersCount = 1000;  // e.g. limit to 1000 headers
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
// by not allowing 2000+ headers to be sent and causing a DoS
// headers will instead be limited by the maxHeaderSize
server.maxHeadersCount = 0;
// Mitigate against https://github.com/triggerdotdev/trigger.dev/security/dependabot/128
// by capping the number of headers; rely on header-size limits for payload size
// Remove override to use default (2000) or choose a custom cap:
server.maxHeadersCount = 1000; // e.g. limit to 1000 headers
🤖 Prompt for AI Agents 
In apps/webapp/server.ts around lines 132 to 135, the current setting of
server.maxHeadersCount = 0 disables the header count limit, allowing unlimited
headers, which contradicts the intended DoS mitigation. To fix this, either
remove this override to use the default limit of 2000 headers or set
maxHeadersCount to a positive integer like 1000 to enforce a stricter limit that
fits your security requirements.


process.on("SIGTERM", () => {
server.close((err) => {
Expand Down
107 changes: 39 additions & 68 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion references/d3-chat/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@
"@ai-sdk/openai": "1.3.3",
"@e2b/code-interpreter": "^1.1.0",
"@radix-ui/react-avatar": "^1.1.3",
"@slack/web-api": "^6.8.1",
"@slack/web-api": "7.9.1",
"@trigger.dev/python": "workspace:*",
"@trigger.dev/react-hooks": "workspace:*",
"@trigger.dev/sdk": "workspace:*",
Expand Down
2 changes: 1 addition & 1 deletion references/d3-openai-agents/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@
},
"dependencies": {
"@ai-sdk/openai": "1.3.3",
"@slack/web-api": "^6.8.1",
"@slack/web-api": "7.9.1",
"@trigger.dev/python": "workspace:*",
"@trigger.dev/react-hooks": "workspace:*",
"@trigger.dev/sdk": "workspace:*",
Expand Down