-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Release: 0.10.0 #392
Release: 0.10.0 #392
Conversation
Bumps [supertest](https://github.com/ladjs/supertest) from 6.3.4 to 7.0.0. - [Release notes](https://github.com/ladjs/supertest/releases) - [Commits](ladjs/supertest@v6.3.4...v7.0.0) --- updated-dependencies: - dependency-name: supertest dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.12.7 to 20.12.11. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 3 to 4. - [Release notes](https://github.com/pnpm/action-setup/releases) - [Commits](pnpm/action-setup@v3...v4) --- updated-dependencies: - dependency-name: pnpm/action-setup dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) from 5.12.1 to 5.13.0. - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/5.13.0/packages/client) --- updated-dependencies: - dependency-name: "@prisma/client" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 7.6.0 to 7.9.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.9.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps node from 21-slim to 22-slim. --- updated-dependencies: - dependency-name: node dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4.3.0 to 4.3.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4.3.0...v4.3.1) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.12.0 to 8.13.0. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v8.12.0...v8.13.0) --- updated-dependencies: - dependency-name: ajv dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [fluent-ffmpeg](https://github.com/fluent-ffmpeg/node-fluent-ffmpeg) from 2.1.2 to 2.1.3. - [Commits](fluent-ffmpeg/node-fluent-ffmpeg@v2.1.2...v2.1.3) --- updated-dependencies: - dependency-name: fluent-ffmpeg dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…208) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 7.7.1 to 7.9.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.9.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4.3.1 to 4.4.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4.3.1...v4.4.0) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) from 5.13.0 to 5.14.0. - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/5.14.0/packages/client) --- updated-dependencies: - dependency-name: "@prisma/client" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [lint-staged](https://github.com/okonet/lint-staged) from 15.2.2 to 15.2.5. - [Release notes](https://github.com/okonet/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/master/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v15.2.2...v15.2.5) --- updated-dependencies: - dependency-name: lint-staged dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
fix: init avatarservice only once
…n/lint-staged-15.2.5 chore(deps-dev): bump lint-staged from 15.2.2 to 15.2.5
…221) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 7.9.0 to 7.12.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.12.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4.4.0 to 4.4.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4.4.0...v4.4.1) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 20.12.11 to 20.14.2. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [prisma](https://github.com/prisma/prisma/tree/HEAD/packages/cli) from 5.13.0 to 5.15.0. - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/5.15.0/packages/cli) --- updated-dependencies: - dependency-name: prisma dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…n/nestjs/cli-11.0.2 chore(deps-dev): bump @nestjs/cli from 10.4.7 to 11.0.2
Bumps [@commitlint/config-conventional](https://github.com/conventional-changelog/commitlint/tree/HEAD/@commitlint/config-conventional) from 19.6.0 to 19.7.1. - [Release notes](https://github.com/conventional-changelog/commitlint/releases) - [Changelog](https://github.com/conventional-changelog/commitlint/blob/master/@commitlint/config-conventional/CHANGELOG.md) - [Commits](https://github.com/conventional-changelog/commitlint/commits/v19.7.1/@commitlint/config-conventional) --- updated-dependencies: - dependency-name: "@commitlint/config-conventional" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps @nestjs/elasticsearch from 10.0.1 to 11.0.0. --- updated-dependencies: - dependency-name: "@nestjs/elasticsearch" dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [husky](https://github.com/typicode/husky) from 9.1.6 to 9.1.7. - [Release notes](https://github.com/typicode/husky/releases) - [Commits](typicode/husky@v9.1.6...v9.1.7) --- updated-dependencies: - dependency-name: husky dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.4.0 to 8.24.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.24.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…n/typescript-eslint/eslint-plugin-8.24.0 chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.4.0 to 8.24.0
Bumps [prettier](https://github.com/prettier/prettier) from 3.3.3 to 3.5.1. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.3.3...3.5.1) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
…n/husky-9.1.7 chore(deps-dev): bump husky from 9.1.6 to 9.1.7
…n/nestjs/elasticsearch-11.0.0 chore(deps): bump @nestjs/elasticsearch from 10.0.1 to 11.0.0
…n/commitlint/config-conventional-19.7.1 chore(deps-dev): bump @commitlint/config-conventional from 19.6.0 to 19.7.1
…n/prettier-3.5.1 chore(deps-dev): bump prettier from 3.3.3 to 3.5.1
* docs(api): passkey authentication endpoints and schemas * feat(auth): implement passkey authentication This commit adds comprehensive passkey authentication and management features: - Added WebAuthn passkey registration and authentication endpoints - Created new Prisma model for storing passkey credentials - Added Redis-based challenge management for WebAuthn flows * feat(auth): implement sudo mode authentication Add sudo mode verification with enhanced security: - Introduce new authorization mechanism with sudo token expiration - Add endpoint and service methods for sudo mode verification - Support password and passkey-based sudo authentication * test(auth): add comprehensive tests for sudo mode and passkey authentication Expand test coverage for authentication features: - Add unit tests for sudo mode verification with password and passkey - Implement E2E tests for sudo mode and passkey authentication endpoints - Mock WebAuthn server methods for consistent testing - Cover various authentication scenarios including edge cases * ci: add Valkey (Redis) service * feat(docker): add Valkey service * perf(auth): truncating credentialId in error messages * fix(redis): add fallback values for Redis configuration * test(auth): reorder E2E tests for passkey authentication * feat(auth): implement two-factor authentication (2FA) with TOTP Add comprehensive two-factor authentication features: - Implement TOTP (Time-based One-Time Password) authentication - Implement risk-based 2FA verification with configurable settings - Support backup codes for account recovery - Enhance login flow with 2FA verification * test(auth): add comprehensive tests for TOTP service Add detailed unit tests for the TOTPService covering: - TOTP secret generation and URI creation - 2FA lifecycle (enable, disable) - Verification process for TOTP and backup codes - Edge cases and token generation
Add database schema changes to support: - Passkey authentication with credential storage - Two-factor authentication (TOTP) configuration - User backup code management
* feat(auth): implement Secure Remote Password (SRP) authentication * chore(config): update sample environment configuration * test: add isLegacyAuth flag to registration in E2E tests * test(users): enhance users module tests with SRP and password reset scenarios * chore(ci): update pnpm version to 10 * test(users): refactor and clean up user module E2E tests * test(users): create a dedicated test user for passkey authentication
Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.24.0 to 8.24.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.24.1/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [eslint-plugin-prettier](https://github.com/prettier/eslint-plugin-prettier) from 5.2.1 to 5.2.3. - [Release notes](https://github.com/prettier/eslint-plugin-prettier/releases) - [Changelog](https://github.com/prettier/eslint-plugin-prettier/blob/master/CHANGELOG.md) - [Commits](prettier/eslint-plugin-prettier@v5.2.1...v5.2.3) --- updated-dependencies: - dependency-name: eslint-plugin-prettier dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 6.9.15 to 6.10.0. - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.15...v6.10.0) --- updated-dependencies: - dependency-name: nodemailer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@prisma/client](https://github.com/prisma/prisma/tree/HEAD/packages/client) from 5.20.0 to 6.4.1. - [Release notes](https://github.com/prisma/prisma/releases) - [Commits](https://github.com/prisma/prisma/commits/6.4.1/packages/client) --- updated-dependencies: - dependency-name: "@prisma/client" dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
…n/prisma/client-6.4.1 chore(deps): bump @prisma/client from 5.20.0 to 6.4.1
…n/nodemailer-6.10.0 chore(deps): bump nodemailer from 6.9.15 to 6.10.0
…n/eslint-plugin-prettier-5.2.3 chore(deps-dev): bump eslint-plugin-prettier from 5.2.1 to 5.2.3
…n/typescript-eslint/eslint-plugin-8.24.1 chore(deps-dev): bump @typescript-eslint/eslint-plugin from 8.24.0 to 8.24.1
Important Review skippedMore than 25% of the files skipped due to max files limit. The review is being skipped to prevent a low-quality review. 111 files out of 232 files are above the max files limit of 100. Please upgrade to Pro plan to get higher limits. You can disable this status message by setting the Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
session({ | ||
store: redisStore, | ||
secret: process.env.SESSION_SECRET ?? 'secret', | ||
resave: false, | ||
saveUninitialized: false, | ||
cookie: { | ||
httpOnly: true, | ||
sameSite: 'strict', | ||
}, | ||
}), |
Check warning
Code scanning / CodeQL
Clear text transmission of sensitive cookie Medium
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the session cookie is only transmitted over HTTPS by setting the secure
attribute on the cookie. This can be done by modifying the session configuration to include the secure
attribute, which should be set to true
when the application is not in development mode (IS_DEV
is false
). This change ensures that the cookie is only sent over secure connections in production environments.
-
Copy modified line R45
@@ -44,2 +44,3 @@ | ||
sameSite: 'strict', | ||
secure: !IS_DEV, | ||
}, |
session({ | ||
secret: 'testSecret', | ||
resave: false, | ||
saveUninitialized: false, | ||
}), |
Check warning
Code scanning / CodeQL
Clear text transmission of sensitive cookie Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 5 days ago
To fix the problem, we need to ensure that the session cookie is only transmitted over HTTPS by setting the secure
attribute to true
in the session configuration. This change will enforce SSL encryption for the cookie, mitigating the risk of interception.
- Modify the session configuration in the
beforeAll
hook to include thesecure
attribute. - Ensure that the
secure
attribute is set totrue
when configuring the session middleware.
-
Copy modified line R242
@@ -241,2 +241,3 @@ | ||
saveUninitialized: false, | ||
cookie: { secure: true }, | ||
}), |
Bumps [rxjs](https://github.com/reactivex/rxjs) from 7.8.1 to 7.8.2. - [Release notes](https://github.com/reactivex/rxjs/releases) - [Changelog](https://github.com/ReactiveX/rxjs/blob/7.8.2/CHANGELOG.md) - [Commits](ReactiveX/rxjs@7.8.1...7.8.2) --- updated-dependencies: - dependency-name: rxjs dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
…n/rxjs-7.8.2 chore(deps): bump rxjs from 7.8.1 to 7.8.2
No description provided.