@checkstack/auth-backend 0.4.25 → 0.4.27
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +55 -0
- package/package.json +8 -7
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,60 @@
|
|
|
1
1
|
# @checkstack/auth-backend
|
|
2
2
|
|
|
3
|
+
## 0.4.27
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- b33fb4d: Refresh `bun.lock` to clear MEDIUM-severity Trivy advisories on transitive
|
|
8
|
+
runtime dependencies. No public API change — bumping every workspace
|
|
9
|
+
package that lists `@orpc/server` as a direct dep so consumers re-resolve
|
|
10
|
+
the optional `ws` peer to the patched release on their next install.
|
|
11
|
+
|
|
12
|
+
- `ws` `8.20.0` → `8.20.1` (CVE-2026-45736). Pulled into the install tree
|
|
13
|
+
as `@orpc/server`'s optional WebSocket peer; Bun auto-installs it into
|
|
14
|
+
every backend package that depends on `@orpc/server`, so a stale 8.20.0
|
|
15
|
+
ships in the consumer's `node_modules` until the parent package
|
|
16
|
+
re-resolves.
|
|
17
|
+
- `brace-expansion` `5.0.5` → `5.0.6` (CVE-2026-45149). Pulled in only
|
|
18
|
+
through dev tooling (`minimatch@10` via `@typescript-eslint` and
|
|
19
|
+
`storybook`'s `glob@13`), so it does not ship to consumers and no
|
|
20
|
+
workspace `package.json` lists it; the lockfile bump alone clears the
|
|
21
|
+
finding for the Docker image and the local dev tree. No version bump
|
|
22
|
+
is attributed to this advisory.
|
|
23
|
+
|
|
24
|
+
The fix lives entirely in `bun.lock` — no `package.json`, `overrides`, or
|
|
25
|
+
`resolutions` change is needed because both parent ranges (`minimatch@10
|
|
26
|
+
→ brace-expansion@^5.0.5`, `@orpc/server / storybook / happy-dom →
|
|
27
|
+
ws@>=8.18.x`) already accept the patched releases, and `bun install`
|
|
28
|
+
keeps the resolved versions sticky after the initial `bun update`.
|
|
29
|
+
|
|
30
|
+
- Updated dependencies [1909a61]
|
|
31
|
+
- Updated dependencies [b33fb4d]
|
|
32
|
+
- @checkstack/backend-api@0.15.3
|
|
33
|
+
- @checkstack/command-backend@0.1.27
|
|
34
|
+
|
|
35
|
+
## 0.4.26
|
|
36
|
+
|
|
37
|
+
### Patch Changes
|
|
38
|
+
|
|
39
|
+
- 080627f: Pin `kysely` to `^0.28.17` as a direct dependency to resolve CVE-2026-44635
|
|
40
|
+
(JSON-path traversal injection via unsanitized path-leg metacharacters in
|
|
41
|
+
`JSONPathBuilder.key()` / `.at()`). better-auth lists kysely as a peer
|
|
42
|
+
dependency, and Bun was auto-resolving it through the optionalPeers
|
|
43
|
+
mechanism — pinning here keeps us inside better-auth's peer range
|
|
44
|
+
(`^0.28.5`) while picking up the fix.
|
|
45
|
+
|
|
46
|
+
Two unrelated transitive vulnerabilities (`fast-uri` 3.1.0 → 3.1.2 covering
|
|
47
|
+
CVE-2026-6321/6322, `protobufjs` 7.5.5 → 7.5.8 covering
|
|
48
|
+
CVE-2026-44289/44290/44291/44293) were resolved by a plain lockfile refresh
|
|
49
|
+
and do not require package version bumps.
|
|
50
|
+
|
|
51
|
+
- Updated dependencies [9016526]
|
|
52
|
+
- @checkstack/common@0.10.0
|
|
53
|
+
- @checkstack/auth-common@0.7.0
|
|
54
|
+
- @checkstack/notification-common@1.1.0
|
|
55
|
+
- @checkstack/backend-api@0.15.2
|
|
56
|
+
- @checkstack/command-backend@0.1.26
|
|
57
|
+
|
|
3
58
|
## 0.4.25
|
|
4
59
|
|
|
5
60
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@checkstack/auth-backend",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.27",
|
|
4
4
|
"license": "Elastic-2.0",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "src/index.ts",
|
|
@@ -15,21 +15,22 @@
|
|
|
15
15
|
"test": "bun test"
|
|
16
16
|
},
|
|
17
17
|
"dependencies": {
|
|
18
|
-
"@checkstack/auth-common": "0.
|
|
19
|
-
"@checkstack/backend-api": "0.15.
|
|
20
|
-
"@checkstack/notification-common": "1.0
|
|
21
|
-
"@checkstack/command-backend": "0.1.
|
|
18
|
+
"@checkstack/auth-common": "0.7.0",
|
|
19
|
+
"@checkstack/backend-api": "0.15.2",
|
|
20
|
+
"@checkstack/notification-common": "1.1.0",
|
|
21
|
+
"@checkstack/command-backend": "0.1.26",
|
|
22
22
|
"better-auth": "^1.4.7",
|
|
23
23
|
"drizzle-orm": "^0.45.0",
|
|
24
24
|
"hono": "^4.12.14",
|
|
25
|
+
"kysely": "^0.28.17",
|
|
25
26
|
"jose": "^6.1.3",
|
|
26
27
|
"zod": "^4.2.1",
|
|
27
|
-
"@checkstack/common": "0.
|
|
28
|
+
"@checkstack/common": "0.10.0",
|
|
28
29
|
"@orpc/server": "^1.13.2"
|
|
29
30
|
},
|
|
30
31
|
"devDependencies": {
|
|
31
32
|
"@checkstack/drizzle-helper": "0.0.5",
|
|
32
|
-
"@checkstack/scripts": "0.3.
|
|
33
|
+
"@checkstack/scripts": "0.3.2",
|
|
33
34
|
"@checkstack/tsconfig": "0.0.7",
|
|
34
35
|
"@types/node": "^20.0.0",
|
|
35
36
|
"drizzle-kit": "^0.31.10",
|