Repository navigation
deps: bump express-rate-limit from 7.5.1 to 8.6.2 - #158
DanFashauer merged 2 commits into
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
🧭 PR triage
CI runs the full gate suite (build, typecheck, proofs, API tests, safety gate). This comment updates on each push. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d28865a302
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "cors": "^2.8.6", | ||
| "express": "^5.2.1", | ||
| "express-rate-limit": "^7.4.0", | ||
| "express-rate-limit": "^8.6.1", |
There was a problem hiding this comment.
This bump changes the resolved express-rate-limit package to 8.6.1 (and ip-address to 10.4.0), but the tracked CycloneDX SBOM still lists express-rate-limit 7.5.1/8.5.2 and ip-address 10.2.0 in artifacts/sbom/cyclonedx.json. The supply-chain workflow regenerates the SBOM and then runs git diff --exit-code -- artifacts/sbom/cyclonedx.json (.github/workflows/supply-chain.yml:52-55), so this dependency-only change will fail that CI job and leave the committed SBOM inaccurate until pnpm run sbom is included.
Useful? React with 👍 / 👎.
| "cors": "^2.8.6", | ||
| "express": "^5.2.1", | ||
| "express-rate-limit": "^7.4.0", | ||
| "express-rate-limit": "^8.6.1", |
There was a problem hiding this comment.
With express-rate-limit 8.x, the package now validates custom key generators, and the existing /v1 limiter falls back to raw req.ip without ipKeyGenerator (artifacts/api-server/src/middlewares/rateLimit.ts:20-22). Because that limiter is registered before auth for /api/v1/* requests, unauthenticated IPv6 callers can still rotate privacy addresses to bypass the intended 240/minute bucket, and the server will log ERR_ERL_KEY_GEN_IPV6 at startup; use ipKeyGenerator(req.ip) for the fallback (or explicitly accept/disable that validation if the weaker behavior is intended).
Useful? React with 👍 / 👎.
The grouping fix (f51d86a) worked — dependabot regenerated #154's 65-package wall as one safe batch of 48 plus seven isolated majors. Then all eight came back RED, and four of them failed NOTHING BUT the CycloneDX SBOM check. That is not eight coincidences. The gate runs `pnpm run sbom` and then `git diff --exit-code` on the committed file. Dependabot changes the lockfile and cannot regenerate the SBOM, so the committed copy is stale by definition and the step fails on EVERY dependency PR it will ever open. The invariant is right — the committed SBOM should match the lockfile. The enforcement was self-defeating: a guard no automated update can ever satisfy does not enforce anything, it guarantees a permanently red bot and teaches reviewers that this particular red means nothing. That is worse than not having it, because it erodes the signal of every other check next to it. So on dependabot's own branches the SBOM is regenerated AND COMMITTED rather than merely failed. The invariant is kept true instead of asserted, and review is about the dependency change rather than a mechanical file the bot could never touch. Tightly gated: dependabot only, same-repo branches only (never a fork), only when the SBOM actually changed, and `contents: write` is scoped to THIS JOB — the workflow default stays read-only and secret-scan keeps inheriting read. A GITHUB_TOKEN push does not retrigger workflows, so it cannot loop. One bug caught before pushing rather than after: on a pull_request event actions/checkout gives a MERGE commit in detached HEAD, so pushing HEAD back would have sent the merge rather than the branch. The checkout now takes the PR's real head ref, which also means the SBOM is generated from what the branch actually contains. Expected effect: #155 (48 minor/patch updates), #158, #161 and #162 should go green on their next run, since the SBOM was their only failure. The four with real compile breakage (#156 pino, #157 react-resizable-panels, #159 vite, #160 pino-http) stay red for their own reasons, which is exactly what isolating majors was for. All 12 workflows parse; preflight green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N7uHGuc22upGPW3AZvHLAn
dependabot
Bot
changed the title
d28865a to
82de979
Compare
Bumps [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) from 7.5.1 to 8.6.2. - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v7.5.1...v8.6.2) --- updated-dependencies: - dependency-name: express-rate-limit dependency-version: 8.6.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
82de979 to
7227ff4
Compare
Bumps express-rate-limit from 7.5.1 to 8.6.2.
Release notes
Sourced from express-rate-limit's releases.
Commits
c416f788.6.2defb334v8.6.2 changelog7dd82cffix: key IPv4-in-IPv6 addresses by range, not notation (#667)4e23dbbchore(deps): bump ip-address from 10.3.1 to 10.4.0 (#666)607ef1fchore(deps): bump ip-address from 10.2.0 to 10.3.1 (#664)d2370f6chore(deps-dev): bump the development-dependencies group with 5 updates (#663)c7fced58.6.1b21110echore: deprecate millisecond-based time constants (#662)fad3d85chore(deps-dev): bump the development-dependencies group with 4 updates (#660)fffb3c48.6.0Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for express-rate-limit since your current version.
Install script changes
This version modifies
preparescript that runs during installation. Review the package contents before updating.