@formio/appserver 2.14.0 → 2.15.0

package/lib/actions/login/LoginAction.js

@@ -154,17 +154,23 @@ exports.LoginAction = {
     },
     executor(actionForm, action, handler, method) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a, _b;
             let loginProvider = null;
-            if (!action.settings.provider || action.settings.provider !== 'local') {
-                loginProvider = new appserver_core_1.LocalAuthProvider(actionForm.project, (0, lodash_1.defaultsDeep)((_b = (_a = actionForm.project) === null || _a === void 0 ? void 0 : _a.config) === null || _b === void 0 ? void 0 : _b.auth, {
-                    local: action.settings
-                }));
+            // Each login action gets its own copy of the auth config: the project's
+            // config is shared by every form, so mutating it would let the first
+            // login action's settings leak into all the others. The action's own
+            // settings take precedence; the project's fill in what it leaves out.
+            const settings = (0, lodash_1.cloneDeep)(action.settings || {});
+            const projectAuth = (0, lodash_1.cloneDeep)(((_b = (_a = actionForm.project) === null || _a === void 0 ? void 0 : _a.config) === null || _b === void 0 ? void 0 : _b.auth) || {});
+            const provider = settings.provider || 'local';
+            if (provider === 'local') {
+                // The settings form names the login fields `username` and `password`;
+                // the provider reads them as `userfield` and `passfield`.
+                const local = Object.assign(Object.assign({}, settings), { userfield: settings.userfield || settings.username, passfield: settings.passfield || settings.password });
+                loginProvider = new appserver_core_1.LocalAuthProvider(actionForm.project, (0, lodash_1.defaultsDeep)({ local }, projectAuth));
             }
-            else if (action.settings.provider === 'oidc') {
-                loginProvider = new appserver_core_1.OIDCProvider(actionForm.project, (0, lodash_1.defaultsDeep)((_d = (_c = actionForm.project) === null || _c === void 0 ? void 0 : _c.config) === null || _d === void 0 ? void 0 : _d.auth, {
-                    oidc: action.settings
-                }));
+            else if (provider === 'oidc') {
+                loginProvider = new appserver_core_1.OIDCProvider(actionForm.project, (0, lodash_1.defaultsDeep)({ oidc: settings }, projectAuth));
             }
             if (loginProvider === null || loginProvider === void 0 ? void 0 : loginProvider.initialize) {
                 yield loginProvider.initialize();

package/lib/actions/role/RoleAction.js

@@ -107,7 +107,7 @@ exports.RoleAction = {
     executor(form, action, handler, method) {
         return __awaiter(this, void 0, void 0, function* () {
             return (req, res, next) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b, _c;
+                var _a, _b, _c, _d;
                 debug('Role Action');
                 // Check the submission for the submissionId.
                 if (action.settings.association !== 'existing' && action.settings.association !== 'new') {
@@ -151,12 +151,18 @@ exports.RoleAction = {
                         if (roleIndex === -1) {
                             return next();
                         }
-                        resource.roles.slice(roleIndex, 1);
+                        resource.roles.splice(roleIndex, 1);
                         break;
                 }
                 debug('Updating user with roles', resource.roles);
-                // Update the user.
-                yield form.saveSubmission(resource, ['roles'], req.auth);
+                // Update the user through the form the resource belongs to. After a
+                // Save action to another resource, the resource is that form's
+                // submission, and saving it through this form would match nothing.
+                const resourceFormId = resource.form ? String(resource.form) : '';
+                const target = (resourceFormId && resourceFormId !== String((_d = form.form) === null || _d === void 0 ? void 0 : _d._id))
+                    ? (yield form.project.getFormById(resourceFormId)) || form
+                    : form;
+                yield target.saveSubmission(resource, ['roles'], req.auth);
                 next();
             });
         });

package/lib/actions/save/SaveAction.js

@@ -41,7 +41,7 @@ exports.SaveAction = {
     },
     mappingComponents(form) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a;
+            var _a, _b;
             const components = [
                 {
                     type: 'select',
@@ -89,8 +89,11 @@ exports.SaveAction = {
                     customConditional: `show = row.mapType === 'simple' && row.resource === "${key}"`,
                     components: []
                 };
+                // Each resource field is mapped from a field of this form, so the
+                // options are this form's fields (childSubmission reads them from
+                // the submitted data by these keys).
                 const toFields = [];
-                appserver_core_1.Utils.eachComponent(resource.components, (component) => {
+                appserver_core_1.Utils.eachComponent(((_b = form.form) === null || _b === void 0 ? void 0 : _b.components) || [], (component) => {
                     if (['button'].indexOf(component.type) !== -1) {
                         return;
                     }
@@ -220,6 +223,14 @@ exports.SaveAction = {
             catch (err) {
                 console.log(`Error in mapping transform: ${err.message}`);
             }
+            // A script that fails, or never assigns `body`, yields nothing usable.
+            if (!childSub || typeof childSub !== 'object') {
+                error('The advanced mapping did not produce a body; saving an empty resource submission.');
+                childSub = { data: {} };
+            }
+            if (!childSub.data || typeof childSub.data !== 'object') {
+                childSub.data = {};
+            }
         }
         else {
             (0, each_1.default)(action.settings.fields, function (field, key) {
@@ -234,7 +245,13 @@ exports.SaveAction = {
         childSub.metadata = submission.metadata;
         if (action.settings.transform) {
             try {
-                childSub.data = appserver_core_1.Utils.evaluate(action.settings.transform, appserver_core_1.Utils.evalContext(form, req.submission || req.body, req.auth, req.headers, req.findQuery), 'data');
+                // `submission` is the original request; `data` is the data
+                // already produced by the mappings above.
+                const transformed = appserver_core_1.Utils.evaluate(action.settings.transform, Object.assign(Object.assign({}, appserver_core_1.Utils.evalContext(form, req.submission || req.body, req.auth, req.headers, req.findQuery)), { data: childSub.data }), 'data');
+                // A failed transform leaves the mapped data as it was.
+                if (transformed && typeof transformed === 'object') {
+                    childSub.data = transformed;
+                }
             }
             catch (err) {
                 console.log(`Error in submission transform: ${err.message}`);
@@ -285,28 +302,32 @@ exports.SaveAction = {
                 if ((_a = action.settings) === null || _a === void 0 ? void 0 : _a.resource) {
                     debug('Saving to resource: ' + action.settings.resource);
                     const saveTo = yield form.project.getForm(action.settings.resource);
-                    if (saveTo) {
-                        if (!saveTo.handlers) {
-                            error('Cannot find resource handlers.');
-                            return next('Cannot find resource handlers.');
-                        }
-                        const handlers = req.method === 'PUT' ? saveTo.handlers.update : saveTo.handlers.create;
-                        const childReq = appserver_core_1.Utils.childRequest(req);
-                        if (!childReq) {
-                            error('Failed to create child request');
-                            return next('Failed to create child request');
-                        }
-                        childReq.body = exports.SaveAction.childSubmission(action, req, res, saveTo, childReq.body);
-                        return async_1.default.series(handlers.map((handler) => async_1.default.apply(handler, childReq, res)), (err) => {
-                            if (err) {
-                                error(err);
-                                return next(err);
-                            }
-                            // Set the child response based on the response of the subform.
-                            exports.SaveAction.childResponse(action, req, res, saveTo, childReq.body);
-                            next();
-                        });
+                    if (!saveTo) {
+                        // Never fall back to saving into this form: the data was
+                        // meant for another resource.
+                        error(`Resource "${action.settings.resource}" not found for the save action.`);
+                        return next(`Resource "${action.settings.resource}" not found.`);
+                    }
+                    if (!saveTo.handlers) {
+                        error('Cannot find resource handlers.');
+                        return next('Cannot find resource handlers.');
+                    }
+                    const handlers = req.method === 'PUT' ? saveTo.handlers.update : saveTo.handlers.create;
+                    const childReq = appserver_core_1.Utils.childRequest(req);
+                    if (!childReq) {
+                        error('Failed to create child request');
+                        return next('Failed to create child request');
                     }
+                    childReq.body = exports.SaveAction.childSubmission(action, req, res, saveTo, childReq.body);
+                    return async_1.default.series(handlers.map((handler) => async_1.default.apply(handler, childReq, res)), (err) => {
+                        if (err) {
+                            error(err);
+                            return next(err);
+                        }
+                        // Set the child response based on the response of the subform.
+                        exports.SaveAction.childResponse(action, req, res, saveTo, childReq.body);
+                        next();
+                    });
                 }
                 // Save the submission.
                 req.saveSubmission = true;

package/lib/modules/mongodb/db.d.ts

@@ -1,12 +1,20 @@
 import { Collection, Document, Db, MongoClient, FindOneOptions } from 'mongodb';
 import { Component, Submission } from '@formio/core';
 import { ServerDB, DBConfig, AppServerForm, DatabaseIndexResponse, IndexQuery } from '@formio/appserver-core';
+/**
+ * Whether a URL filter names a field. Mongo operators (`$where`, `$expr`, ...)
+ * and prototype keys are never fields, and would let a caller run JavaScript in
+ * the database or change the query's structure.
+ */
+export declare function isFilterField(name: string): boolean;
 export declare class Database implements ServerDB {
     config: DBConfig;
     db: Db | null;
     client: MongoClient | null;
     currentCollectionName: string;
     currentCollection: Collection<Document> | null;
+    /** Collections for forms with `settings.collection`, created and indexed once each. */
+    formCollections: Map<string, Collection<Document>>;
     defaultCollection: Collection<Document> | null;
     prefix: string;
     constructor(config: DBConfig);
@@ -88,7 +96,13 @@ export declare class Database implements ServerDB {
      * @param {*} id
      * @returns
      */
-    query(form: AppServerForm, query?: any, includeAll?: boolean): any;
+    /**
+     * Scope a query to the form and project. Including deleted records drops only
+     * the `deleted` filter, never the form or project scope: every form writes to
+     * the shared submissions collection. `scope = false` is for nested
+     * `$or`/`$and` clauses, which only need their ids converted.
+     */
+    query(form: AppServerForm, query?: any, includeDeleted?: boolean, scope?: boolean): any;
     /**
      * Find many records that match a query.
      */

package/lib/modules/mongodb/db.js

@@ -21,14 +21,30 @@ var __rest = (this && this.__rest) || function (s, e) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Database = void 0;
+exports.isFilterField = isFilterField;
 const mongodb_1 = require("mongodb");
 const lodash_1 = require("lodash");
 const core_1 = require("@formio/core");
 const debug = require('debug')('formio:db');
 const error = require('debug')('formio:error');
+/** The operators a URL filter may use (`data.age__gt=3`). */
+const FILTER_SELECTORS = ['eq', 'ne', 'gt', 'gte', 'lt', 'lte', 'in', 'nin', 'exists', 'regex'];
+/** The default and largest number of records an index request returns. */
+const DEFAULT_LIMIT = 10;
+const MAX_LIMIT = 1000;
+/**
+ * Whether a URL filter names a field. Mongo operators (`$where`, `$expr`, ...)
+ * and prototype keys are never fields, and would let a caller run JavaScript in
+ * the database or change the query's structure.
+ */
+function isFilterField(name) {
+    return !!name && name.split('.').every((segment) => !!segment && !segment.startsWith('$') && !['__proto__', 'constructor', 'prototype'].includes(segment));
+}
 class Database {
     constructor(config) {
         this.config = config;
+        /** Collections for forms with `settings.collection`, created and indexed once each. */
+        this.formCollections = new Map();
         this.prefix = '';
         this.db = null;
         this.client = null; // Add this line
@@ -37,8 +53,18 @@ class Database {
         this.defaultCollection = null;
     }
     ObjectId(id) {
-        if (id === null || id === void 0 ? void 0 : id.hasOwnProperty('$in')) {
-            return { $in: id['$in'].map((_id) => this.ObjectId(_id)) };
+        // Operator objects from URL filters (`_id__in`, `owner__ne`, ...) convert
+        // their operand(s), so the comparison is against stored ObjectIds.
+        // Every operator is converted: dropping one (e.g. the `$eq` of
+        // `owner=x&owner__ne=y`) would widen the query.
+        if ((0, lodash_1.isPlainObject)(id) && Object.keys(id).some((key) => key.startsWith('$'))) {
+            const converted = {};
+            for (const [op, value] of Object.entries(id)) {
+                converted[op] = ['$in', '$nin'].includes(op) && Array.isArray(value)
+                    ? value.map((_id) => this.ObjectId(_id))
+                    : (['$eq', '$ne'].includes(op) ? this.ObjectId(value) : value);
+            }
+            return converted;
         }
         try {
             return id ? (new mongodb_1.ObjectId(id)) : null;
@@ -69,14 +95,15 @@ class Database {
                 if (this.config.dropOnConnect) {
                     yield this.db.dropDatabase();
                 }
-                this.addIndex(this.collection('project'), 'name');
+                yield this.addIndex(this.collection('project'), 'name');
                 this.defaultCollection = this.collection('submissions');
                 yield this.setupIndexes(this.defaultCollection);
                 debug('Connected to database');
             }
             catch (err) {
                 error(err.message);
-                process.exit();
+                // A non-zero code, so supervisors treat a failed connection as a failure.
+                process.exit(1);
             }
         });
     }
@@ -219,24 +246,38 @@ class Database {
         Object.entries(filters).forEach(([name, value]) => {
             // Get the filter object.
             const filter = (0, lodash_1.zipObject)(['name', 'selector'], name.split('__'));
+            // Only field filters with a known operator reach the database.
+            if (!isFilterField(filter.name) || (filter.selector && !FILTER_SELECTORS.includes(filter.selector))) {
+                debug(`Ignoring query filter "${name}"`);
+                return;
+            }
             if (filter.selector) {
                 var filterQuery = dbQuery[filter.name];
-                // Init the filter.
-                if (!filterQuery) {
+                // Init the filter. A plain filter on the same field (`?a=5&a__gt=3`)
+                // is kept as `$eq` alongside the operator.
+                if (filterQuery === undefined) {
                     filterQuery = {};
                 }
+                else if (!(0, lodash_1.isPlainObject)(filterQuery)) {
+                    filterQuery = { $eq: filterQuery };
+                }
                 if (filter.selector === 'exists') {
                     value = ((value === 'true') || (value === '1')) ? true : value;
                     value = ((value === 'false') || (value === '0')) ? false : value;
                     value = !!value;
                 }
                 else if (filter.selector === 'regex') {
-                    const parts = value.match(/\/?([^/]+)\/?([^/]+)?/);
-                    if (!parts) {
+                    // Either `/pattern/flags` or a bare pattern. The pattern is always
+                    // matched literally: login builds these filters from user input,
+                    // so unescaped patterns would allow regex injection.
+                    const delimited = String(value).match(/^\/([\s\S]*)\/([a-z]*)$/);
+                    const pattern = delimited ? delimited[1] : String(value);
+                    const flags = delimited && /^[gimsuy]*$/.test(delimited[2]) && delimited[2] ? delimited[2] : 'i';
+                    if (!pattern) {
                         return;
                     }
                     try {
-                        value = new RegExp((0, lodash_1.escapeRegExp)(parts[1]), (parts[2] || 'i'));
+                        value = new RegExp((0, lodash_1.escapeRegExp)(pattern), flags);
                     }
                     catch (err) {
                         error(err);
@@ -257,9 +298,15 @@ class Database {
                 return;
             }
             else {
-                // Set the find query to this value.
+                // Set the find query to this value. When an operator filter on the
+                // same field came first, keep it and add this value as `$eq`.
                 value = this.getQueryValue(filter.name, value, filter.selector);
-                dbQuery[filter.name] = value;
+                if ((0, lodash_1.isPlainObject)(dbQuery[filter.name])) {
+                    dbQuery[filter.name].$eq = value;
+                }
+                else {
+                    dbQuery[filter.name] = value;
+                }
                 return;
             }
         });
@@ -294,22 +341,31 @@ class Database {
     formCollection(form) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.db && form && form.settings && form.settings.collection) {
-                if (this.currentCollection && this.currentCollectionName === form.settings.collection) {
-                    return this.currentCollection;
+                const name = form.settings.collection;
+                const cached = this.formCollections.get(name);
+                if (cached) {
+                    this.currentCollection = cached;
+                    this.currentCollectionName = name;
+                    return cached;
                 }
-                let collection = null;
                 try {
-                    debug('db.createCollection()', form.settings.collection);
-                    yield this.db.createCollection(this.collectionName(form.settings.collection));
-                    collection = this.collection(form.settings.collection);
-                    this.setupIndexes(collection, form);
+                    debug('db.createCollection()', name);
+                    yield this.db.createCollection(this.collectionName(name));
                 }
                 catch (err) {
-                    error(err.message);
+                    // 48 = NamespaceExists: the collection is already there, which is fine.
+                    if ((err === null || err === void 0 ? void 0 : err.code) !== 48) {
+                        error(err.message);
+                    }
+                }
+                const collection = this.collection(name);
+                if (collection) {
+                    yield this.setupIndexes(collection, form);
+                    this.formCollections.set(name, collection);
                 }
-                this.currentCollection = collection || this.collection(form.settings.collection);
-                this.currentCollectionName = form.settings.collection;
-                return this.currentCollection;
+                this.currentCollection = collection;
+                this.currentCollectionName = name;
+                return collection;
             }
             return this.defaultCollection;
         });
@@ -322,14 +378,14 @@ class Database {
             if (!collection) {
                 return;
             }
-            this.addIndex(collection, 'project');
-            this.addIndex(collection, 'form');
-            this.addIndex(collection, 'deleted');
-            this.addIndex(collection, 'modified');
+            yield this.addIndex(collection, 'project');
+            yield this.addIndex(collection, 'form');
+            yield this.addIndex(collection, 'deleted');
+            yield this.addIndex(collection, 'modified');
             // If TTL index is needed add that here.
             if (this.config.ttl) {
                 try {
-                    collection.createIndex({
+                    yield collection.createIndex({
                         created: 1
                     }, {
                         background: true,
@@ -341,7 +397,7 @@ class Database {
                 }
             }
             else {
-                this.addIndex(collection, 'created');
+                yield this.addIndex(collection, 'created');
             }
             if (form && form.components) {
                 core_1.Utils.eachComponent(form.components, (component, path) => {
@@ -364,7 +420,7 @@ class Database {
             index[path] = 1;
             try {
                 debug('db.addIndex()', path);
-                collection.createIndex(index, { background: true });
+                yield collection.createIndex(index, { background: true });
             }
             catch (err) {
                 error(`Cannot add index ${path}`, err.message);
@@ -425,9 +481,10 @@ class Database {
      * @returns
      */
     indexQuery(urlQuery) {
-        let skip = 0, limit = 10;
-        limit = parseInt(urlQuery.limit) || 10;
-        skip = parseInt(urlQuery.skip) || 0;
+        // Bounded, so one request can't read (or make the server hold) everything.
+        const maxLimit = Number(this.config.maxLimit) || MAX_LIMIT;
+        const limit = Math.min(Math.max(parseInt(urlQuery.limit) || DEFAULT_LIMIT, 1), maxLimit);
+        const skip = Math.max(parseInt(urlQuery.skip) || 0, 0);
         let sort = { created: -1 };
         if (urlQuery.sort) {
             if (typeof urlQuery.sort === 'string') {
@@ -443,7 +500,8 @@ class Database {
                 sort = urlQuery.sort;
             }
         }
-        const includeDeleted = urlQuery.includeDeleted || false;
+        // Only an explicit "true" includes deleted records ("false" is truthy).
+        const includeDeleted = urlQuery.includeDeleted === true || urlQuery.includeDeleted === 'true';
         let project = {};
         if (urlQuery.select) {
             if (typeof urlQuery.select === 'string') {
@@ -525,7 +583,7 @@ class Database {
             if (form && form._id) {
                 record.form = this.ObjectId(form._id);
             }
-            if (form.project && form.project) {
+            if (form === null || form === void 0 ? void 0 : form.project) {
                 record.project = this.ObjectId(form.project);
             }
             if (record.owner) {
@@ -563,29 +621,37 @@ class Database {
      * @param {*} id
      * @returns
      */
-    query(form, query = {}, includeAll = false) {
+    /**
+     * Scope a query to the form and project. Including deleted records drops only
+     * the `deleted` filter, never the form or project scope: every form writes to
+     * the shared submissions collection. `scope = false` is for nested
+     * `$or`/`$and` clauses, which only need their ids converted.
+     */
+    query(form, query = {}, includeDeleted = false, scope = true) {
         if (query._id) {
             query._id = this.ObjectId(query._id);
         }
         if (query.owner) {
             query.owner = this.ObjectId(query.owner);
         }
-        if (query.form) {
-            query.form = this.ObjectId(query.form);
-        }
-        else if (!includeAll && form && form._id) {
+        // The form scope always wins over a form filter in the query, exactly as
+        // the project scope does: every form shares the submissions collection.
+        if (scope && form && form._id) {
             query.form = this.ObjectId(form._id);
         }
-        if (!includeAll && form.project) {
+        else if (query.form) {
+            query.form = this.ObjectId(query.form);
+        }
+        if (scope && (form === null || form === void 0 ? void 0 : form.project)) {
             query.project = this.ObjectId(form.project);
         }
-        if (!includeAll) {
+        if (scope && !includeDeleted) {
             query.deleted = { $eq: null };
         }
         // Handle nested queries.
         ['$or', '$and'].forEach((key) => {
             if (query[key]) {
-                query[key].forEach((subQuery) => this.query(form, subQuery, true));
+                query[key].forEach((subQuery) => this.query(form, subQuery, true, false));
             }
         });
         return query;
@@ -809,16 +875,23 @@ class Database {
             else if ((0, lodash_1.isArray)(value)) {
                 this.addPathQueryParams({ $all: value }, query, path);
             }
-            else if ((0, lodash_1.isObject)(value) || (0, lodash_1.isNumber)(value)) {
+            else {
+                // Numbers, objects, booleans: match the exact value. Without a value
+                // predicate the query would match any submitted record.
                 this.addPathQueryParams({ $eq: value }, query, path);
             }
             // Only search for non-deleted items
             query.deleted = { $eq: null };
             query.state = 'submitted';
-            // Perform the query.
+            // Perform the query. Errors must reach the catch below (findOne() swallows
+            // them), or a failed lookup would be reported as unique.
+            const lookup = (dbQuery, findOptions) => __awaiter(this, void 0, void 0, function* () {
+                const collection = yield this.formCollection(form);
+                return collection ? yield collection.findOne(this.query(form, dbQuery), findOptions) : null;
+            });
             let result = null;
             try {
-                result = yield this.findOne(form, query, options);
+                result = yield lookup(query, options);
                 if (!(result === null || result === void 0 ? void 0 : result._id) || ((result === null || result === void 0 ? void 0 : result._id.toString()) === (submission === null || submission === void 0 ? void 0 : submission._id))) {
                     return true;
                 }
@@ -835,13 +908,14 @@ class Database {
                         $options: 'i'
                     }, query, path);
                     try {
-                        result = yield this.findOne(form, query);
+                        result = yield lookup(query);
                         if (!(result === null || result === void 0 ? void 0 : result._id) || ((result === null || result === void 0 ? void 0 : result._id.toString()) === (submission === null || submission === void 0 ? void 0 : submission._id))) {
                             return true;
                         }
                         else {
-                            component.conflictId = result._id.toString();
-                            return component.conflictId;
+                            const conflictId = result._id.toString();
+                            component.conflictId = conflictId;
+                            return conflictId;
                         }
                     }
                     catch (err) {

package/lib/server.js

@@ -24,7 +24,6 @@ const appserver_core_1 = require("@formio/appserver-core");
 const modules_1 = require("./modules");
 const actions_1 = __importDefault(require("./actions"));
 const defaultsDeep_1 = __importDefault(require("lodash/defaultsDeep"));
-``;
 const packageJson = require('../package.json');
 const appCorePackage = require('@formio/appserver-core/package.json');
 __exportStar(require("@formio/appserver-core"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@formio/appserver",
-  "version": "2.14.0",
+  "version": "2.15.0",
   "description": "A highly performant and extensible Application Server for Form.io Multi-Tenant Deployments.",
   "main": "lib/server.js",
   "types": "lib/server.d.ts",
@@ -13,7 +13,8 @@
     "build:lib": "npm run clean && tsc; true",
     "test": "mocha",
     "dev": "tsc --watch --preserveWatchOutput",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "test:coverage": "c8 --all --reporter=text-summary --reporter=html --include \"src/**/*.ts\" --exclude \"src/**/*.spec.ts\" mocha"
   },
   "repository": {
     "type": "git",
@@ -33,33 +34,34 @@
   ],
   "homepage": "https://github.com/formio/appserver#readme",
   "dependencies": {
-    "@formio/appserver-core": "^2.14.0",
-    "@formio/core": "2.8.0",
+    "@formio/appserver-core": "^2.15.0",
+    "@formio/core": "2.9.0",
     "async": "^3.2.6",
     "bcryptjs": "^3.0.3",
     "debug": "^4.4.3",
-    "dotenv": "^17.4.2",
-    "express": "^5.2.1",
+    "dotenv": "^18.0.8",
+    "express": "^5.3.0",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.18.1",
-    "mongodb": "^7.5.0"
+    "mongodb": "^7.7.0"
   },
   "devDependencies": {
-    "@types/async": "^3.2.25",
+    "@types/async": "^3.2.26",
     "@types/bcryptjs": "^3.0.0",
     "@types/chai": "^5.2.3",
     "@types/express": "^5.0.6",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/lodash": "^4.17.24",
+    "@types/lodash": "^4.17.26",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^26.1.2",
-    "chai": "^6.2.2",
+    "@types/node": "^26.6.5",
+    "c8": "^12.0.0",
+    "chai": "^6.3.0",
     "cross-env": "^10.1.0",
-    "mocha": "^11.7.6",
-    "mongodb-memory-server": "^11.2.0",
+    "mocha": "^12.0.3",
+    "mongodb-memory-server": "^11.3.0",
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.15",
     "typescript": "^7.0.2"
   }
 }