n8n-nodes-smbclient 1.1.3 → 1.1.6

package/.github/workflows/npm-publish.yml

@@ -1,38 +1,55 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
-
-name: Build and Publish Node.js Package
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-        with:
-          version: latest
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-      - run: pnpm install --frozen-lockfile
-
-  publish-npm:
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-      - uses: pnpm/action-setup@v6
-        with:
-          version: latest
-      - uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org/
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
+# For more information see: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages
+#
+# Nothing is published unless the CVE gate (security-cve.yml) passes first.
+
+name: Build and Publish Node.js Package
+
+on:
+  release:
+    types: [created]
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  # Hard gate: re-scan the exact code being released. A known vulnerability
+  # here blocks build + publish.
+  cve-scan:
+    uses: ./.github/workflows/security-cve.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+  build:
+    needs: cve-scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+        with:
+          version: latest
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+      - run: pnpm install --frozen-lockfile
+
+  publish-npm:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: pnpm/action-setup@v6
+        with:
+          version: latest
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org/
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm publish --no-git-checks
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

package/.github/workflows/one-shot-npm-publish.yml

@@ -20,15 +20,27 @@ on:
         required: true
         type: string
 
-# Needed so the workflow can push the version-bump commit and tag back.
+# `contents: write` so the workflow can push the version-bump commit and tag back;
+# the rest is for the CVE gate's SARIF upload.
 permissions:
+  actions: read
   contents: write
+  security-events: write
 
 jobs:
+  # Hard gate: no bump, no tag, no publish if a known vulnerability is found.
+  cve-scan:
+    uses: ./.github/workflows/security-cve.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
   publish-npm:
+    needs: cve-scan
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           # Use a token that can push the bump commit/tag back to the repo.
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -37,7 +49,7 @@ jobs:
         with:
           version: latest
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org/

package/.github/workflows/security-cve.yml

@@ -0,0 +1,53 @@
+name: CVE Security Scan
+
+on:
+  # Scan every PR targeting main.
+  pull_request:
+    branches:
+      - main
+
+  # Re-scan once the code actually lands on main.
+  push:
+    branches:
+      - main
+
+  # Weekly sweep: catches vulnerabilities disclosed after the code was merged,
+  # without needing any new commit. Mondays at 06:00 UTC.
+  schedule:
+    - cron: '0 6 * * 1'
+
+  # Allow the release workflows to use this workflow as a hard gate.
+  workflow_call:
+
+  # Useful if you want to manually re-check the repository.
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  osv-scan:
+    name: OSV Dependency Scan
+
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.0
+
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    with:
+      # Recursively inspect the repository.
+      # OSV automatically detects pnpm-lock.yaml.
+      scan-args: |-
+        --recursive
+        ./
+
+      # Fail the GitHub Action if a known vulnerability is found.
+      fail-on-vuln: true
+
+      # Upload results to:
+      # GitHub -> Security -> Code scanning
+      upload-sarif: true

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "n8n-nodes-smbclient",
-    "version": "1.1.3",
+    "version": "1.1.6",
     "description": "Transfer files via Samba (SMB2) and smbclient package with n8n, some of the base work are based on https://github.com/drudge/n8n-nodes-smb work.",
     "keywords": [
         "n8n-community-node-package",
@@ -25,7 +25,7 @@
         "format": "prettier nodes credentials --write",
         "lint": "eslint nodes credentials package.json",
         "lintfix": "eslint nodes credentials package.json --fix",
-        "prepublishOnly": "npm run build && npm run lint -c .eslintrc.prepublish.js nodes credentials package.json",
+        "prepublishOnly": "npm run build && npm run lint",
         "release": "npx standard-version"
     },
     "n8n": {
@@ -44,11 +44,11 @@
         "@types/node": "^24.12.4",
         "@typescript-eslint/parser": "^8.59.1",
         "eslint": "^10.3.0",
-        "eslint-plugin-n8n-nodes-base": "^1.16.6",
+        "eslint-plugin-n8n-nodes-base": "^2.0.0",
         "globals": "^17.6.0",
         "gulp": "^5.0.1",
         "prettier": "^3.8.3",
-        "typescript": "^6.0.3"
+        "typescript": "~6.0.3"
     },
     "peerDependencies": {
         "n8n-workflow": "^1.115.0 || ^2.0.0"
@@ -57,7 +57,7 @@
         "tmp-promise": "^3.0.3"
     },
     "overrides": {
-        "form-data": "^4.0.4",
-        "axios": "1.17.0"
+        "form-data": "^4.0.6",
+        "axios": "1.19.0"
     }
 }

package/docker/Dockerfile

@@ -8,10 +8,10 @@
 # into the final image.
 
 # Declared before the first FROM so it can be used in the stage-2 FROM line.
-ARG N8N_VERSION=2.25.6
+ARG N8N_VERSION=2.35.3
 
 # ---- Stage 1: collect smbclient + its dependency files ----
-FROM alpine:3.23 AS smb
+FROM alpine:3.24 AS smb
 RUN set -eux; \
 	apk add --no-cache samba-client 2>&1 | tee /tmp/apk.log; \
 	smbclient --version; \

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-smbclient",
-  "version": "1.1.3",
+  "version": "1.1.6",
   "description": "Transfer files via Samba (SMB2) and smbclient package with n8n, some of the base work are based on https://github.com/drudge/n8n-nodes-smb work.",
   "keywords": [
     "n8n-community-node-package",
@@ -38,11 +38,11 @@
     "@types/node": "^24.12.4",
     "@typescript-eslint/parser": "^8.59.1",
     "eslint": "^10.3.0",
-    "eslint-plugin-n8n-nodes-base": "^1.16.6",
+    "eslint-plugin-n8n-nodes-base": "^2.0.0",
     "globals": "^17.6.0",
     "gulp": "^5.0.1",
     "prettier": "^3.8.3",
-    "typescript": "^6.0.3"
+    "typescript": "~6.0.3"
   },
   "peerDependencies": {
     "n8n-workflow": "^1.115.0 || ^2.0.0"
@@ -51,8 +51,8 @@
     "tmp-promise": "^3.0.3"
   },
   "overrides": {
-    "form-data": "^4.0.4",
-    "axios": "1.17.0"
+    "form-data": "^4.0.6",
+    "axios": "1.19.0"
   },
   "scripts": {
     "build": "npx rimraf dist && tsc && gulp build:icons",

package/pnpm-workspace.yaml

@@ -16,3 +16,20 @@ onlyBuiltDependencies:
 allowBuilds:
   eslint-plugin-n8n-nodes-base: true
   isolated-vm: true
+
+# Force patched versions of transitive dependencies flagged by the OSV scan
+# (see .github/workflows/security-cve.yml). Each entry pins the lowest release
+# that carries the fix; drop an entry once the direct dependency pulls in a
+# patched version on its own.
+#
+# `tmp` is the only one that reaches published consumers — it arrives through
+# our single runtime dependency, tmp-promise. The rest are dev-only, coming in
+# via eslint/gulp.
+overrides:
+  brace-expansion@1: ^1.1.18 # GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
+  brace-expansion@5: ^5.0.9 # GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
+  form-data: ^4.0.6 # GHSA-hmw2-7cc7-3qxx
+  js-yaml@4: ^4.3.1 # GHSA-5p4m-2wfm-xmqj
+  lodash: ^4.18.0 # GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc
+  tmp: ^0.2.6 # GHSA-ph9p-34f9-6g65 (runtime, via tmp-promise)
+  uuid@10: ^11.1.1 # GHSA-w5hq-g745-h8pq

package/renovate.json

@@ -3,5 +3,14 @@
   "extends": [
     "config:recommended"
   ],
-  "minimumReleaseAge": "3 days"
+  "minimumReleaseAge": "3 days",
+  "packageRules": [
+    {
+      "description": "typescript-eslint peers on `typescript >=4.8.4 <6.1.0`, so TypeScript 7 breaks `npm run lint` (and therefore `prepublishOnly`). PR #107 bumped us to v7 and did exactly that. Hold at 6.0.x until typescript-eslint widens its peer range, then drop this rule.",
+      "matchPackageNames": [
+        "typescript"
+      ],
+      "allowedVersions": "<6.1.0"
+    }
+  ]
 }