From bb253fbdd49d4c35ab79ada959650cea9ebe9c3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 01:09:14 +0000 Subject: [PATCH 1/3] chore(deps): bump @supabase/ssr from 0.12.0 to 0.12.3 --- updated-dependencies: - dependency-name: "@supabase/ssr" dependency-version: 0.12.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- package-lock.json | 88 +++++++++++++++++++++++------------------------ package.json | 2 +- 2 files changed, 45 insertions(+), 45 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6f13cb44e..bda137de5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -10,7 +10,7 @@ "hasInstallScript": true, "dependencies": { "@next/env": "16.2.10", - "@supabase/ssr": "^0.12.0", + "@supabase/ssr": "^0.12.3", "@supabase/supabase-js": "^2.108.2", "exceljs": "^4.4.0", "jszip": "^3.10.1", @@ -3286,9 +3286,9 @@ "license": "MIT" }, "node_modules/@supabase/auth-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.2.tgz", - "integrity": "sha512-Qj7a6EDP+AMMQFWqGv+qFa8r6re//dk+qQI5bA0KK+PZmnI3JPu97TDeNt6SMiQ2FkklP79hP2yDFYSnA989OA==", + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/auth-js/-/auth-js-2.110.7.tgz", + "integrity": "sha512-M5Bpl4hCv6kHcOO/xM06Dyfg1mYLHljMkp1plhzG9IRZPc3czvyMsSN1XpL5+GKisOKM3lSN59zhpcm6sMVXfA==", "license": "MIT", "dependencies": { "tslib": "2.8.1" @@ -3298,9 +3298,9 @@ } }, "node_modules/@supabase/functions-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.2.tgz", - "integrity": "sha512-ZjjqrXpxM9/rE+eAtZxiK45EWy9EBoJQ322Q5Y75LccYQNh212neHTgXP/o4MIzmH0LNXT8UzvTZtQOfOzyoeQ==", + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/functions-js/-/functions-js-2.110.7.tgz", + "integrity": "sha512-megYmexlYEoR/0qlsr4Snh9wtzAodO7MAri3NMevZrXzNvQRKlvmTcSBoKGLQEPDakgDZMqbMdf9DwoZz6qfoA==", "license": "MIT", "dependencies": { "tslib": "2.8.1" @@ -3309,12 +3309,31 @@ "node": ">=22.0.0" } }, + "node_modules/@supabase/phoenix": { + "version": "0.4.5", + "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.5.tgz", + "integrity": "sha512-aAn9H9ovVyeApKy11OWOrrOGq8DV68yWeH4ud2lN9fzn4aO8Zb5GLL9m1pUg9nLqIcT+ZDfAcsZe0E/nqdv2lw==", + "license": "MIT" + }, "node_modules/@supabase/postgrest-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.2.tgz", - "integrity": "sha512-++LBmcIMwCtgO4tISQUmo9+2xkRwHQqS8ZKMCnhXLe9P8k8YQRXuMoh/RiSzQSoev8gqet0W7yOboW0cUxnt0Q==", + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/postgrest-js/-/postgrest-js-2.110.7.tgz", + "integrity": "sha512-ban6YV0djhVaqVYezlOARKLIuOBSvLLhyQVZjA2nxPrtswhxHCl1+gI4giFgI9ATQAaMNbUZb4JXiuL5lEA/5g==", + "license": "MIT", + "dependencies": { + "tslib": "2.8.1" + }, + "engines": { + "node": ">=22.0.0" + } + }, + "node_modules/@supabase/realtime-js": { + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.7.tgz", + "integrity": "sha512-AMtZjyFA2gsmjuxopPNS/sRznLQHG0Ht5x+ytTPTOh3vAcOTUlVRLx7gW4/CONNnbb3PKOkE+HmM35HOSbmomQ==", "license": "MIT", "dependencies": { + "@supabase/phoenix": "0.4.5", "tslib": "2.8.1" }, "engines": { @@ -3322,21 +3341,21 @@ } }, "node_modules/@supabase/ssr": { - "version": "0.12.0", - "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.12.0.tgz", - "integrity": "sha512-d9XV5XzJvzzZbeAIM7fWTCUYxQJZ2Ru6ny3dJHmHGp/LIrJ+o9FpD7N9Rf/UhhWEvHXSoDe8SI32Z2ouOdMjBg==", + "version": "0.12.3", + "resolved": "https://registry.npmjs.org/@supabase/ssr/-/ssr-0.12.3.tgz", + "integrity": "sha512-qWXJ/dI7CiYDKyTgIPqJ4Qkh8y5edh2LdF/nkN48z47mmEVzAO2OE+YErYeQ/UemVfonn/F4kFz+lhLqoVMdpw==", "license": "MIT", "dependencies": { "cookie": "^1.0.2" }, "peerDependencies": { - "@supabase/supabase-js": "^2.108.0" + "@supabase/supabase-js": "^2.110.5" } }, "node_modules/@supabase/storage-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.2.tgz", - "integrity": "sha512-EhsRSwSnmQefKJsAxoRUZ0hvHr92ECM8DDGAKR5z0HdoJx4heI60PjHUTruVNZxKX6XeobLGDyLud020Bw1iwg==", + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/storage-js/-/storage-js-2.110.7.tgz", + "integrity": "sha512-2tcDE8cjEDy1uKxKavBpKQod1JdMV1jDXQag48TCa+kycmJOltc0yVabC0BUlhOwAl6WykXU2aOsH3ELMtZrmQ==", "license": "MIT", "dependencies": { "iceberg-js": "^0.8.1", @@ -3347,35 +3366,16 @@ } }, "node_modules/@supabase/supabase-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.2.tgz", - "integrity": "sha512-r9q9w4ZQ6mOjh36aqUNFSisBF611vzpO8JphBESr2Q1SWvmGFQeI7Jq7Y+PaNMZ6Zszz+S2yTlJStCpnaMSnQg==", + "version": "2.110.7", + "resolved": "https://registry.npmjs.org/@supabase/supabase-js/-/supabase-js-2.110.7.tgz", + "integrity": "sha512-AnfO3A230Shy6RMO7cya3Wl1OcXnABJrzH8vP+fY7/RFjhzcchB7DjKkkTIAntlwekD+GkSFzEvt2tC+D4Fp8w==", "license": "MIT", "dependencies": { - "@supabase/auth-js": "2.110.2", - "@supabase/functions-js": "2.110.2", - "@supabase/postgrest-js": "2.110.2", - "@supabase/realtime-js": "2.110.2", - "@supabase/storage-js": "2.110.2" - }, - "engines": { - "node": ">=22.0.0" - } - }, - "node_modules/@supabase/supabase-js/node_modules/@supabase/phoenix": { - "version": "0.4.4", - "resolved": "https://registry.npmjs.org/@supabase/phoenix/-/phoenix-0.4.4.tgz", - "integrity": "sha512-Gt0pqoXuIqX/8dvG0OKp/wMCobXNH3klNbUPBNyOfN0YA1IswrM3HyWFMOPk1Jy+BRaIyDPcFx4jLBwHNmlyfQ==", - "license": "MIT" - }, - "node_modules/@supabase/supabase-js/node_modules/@supabase/realtime-js": { - "version": "2.110.2", - "resolved": "https://registry.npmjs.org/@supabase/realtime-js/-/realtime-js-2.110.2.tgz", - "integrity": "sha512-z3jTOTPgyn6E3r6dVOOQ10He4yAMB2czjFw7xVdX3s16MHElna5rY1gVaePs0NIo6xvtMYbtmOXlFaFt/ePLpg==", - "license": "MIT", - "dependencies": { - "@supabase/phoenix": "0.4.4", - "tslib": "2.8.1" + "@supabase/auth-js": "2.110.7", + "@supabase/functions-js": "2.110.7", + "@supabase/postgrest-js": "2.110.7", + "@supabase/realtime-js": "2.110.7", + "@supabase/storage-js": "2.110.7" }, "engines": { "node": ">=22.0.0" diff --git a/package.json b/package.json index fad4fa8c0..73a7c8898 100644 --- a/package.json +++ b/package.json @@ -176,7 +176,7 @@ }, "dependencies": { "@next/env": "16.2.10", - "@supabase/ssr": "^0.12.0", + "@supabase/ssr": "^0.12.3", "@supabase/supabase-js": "^2.108.2", "exceljs": "^4.4.0", "jszip": "^3.10.1", From 1cdf704c51f1cf4ff80a8390173e35bf88a97561 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:37:18 +0800 Subject: [PATCH 2/3] =?UTF-8?q?=F0=9F=94=A7=20CodeRabbit=20CI=20Fix:=20Fix?= =?UTF-8?q?=20failing=20CI=20checks=20for=20Docker=20image=20builds=20and?= =?UTF-8?q?=20application=20build=20requirements=20(#969)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- scripts/check-client-bundle-secrets.mjs | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/scripts/check-client-bundle-secrets.mjs b/scripts/check-client-bundle-secrets.mjs index 9319a103f..ede366c1f 100644 --- a/scripts/check-client-bundle-secrets.mjs +++ b/scripts/check-client-bundle-secrets.mjs @@ -11,7 +11,11 @@ const forbiddenMarkers = [ "OPENAI_ORG_ID", "OPENAI_PROJECT_ID", "RAG_QUERY_HASH_SECRET", - "sb_secret_", + // Match an actual secret *value* (prefix + a long token), not the bare "sb_secret_" + // prefix string. @supabase/supabase-js's own browser client code legitimately ships + // that literal prefix (isNewApiKey()/checkApiKeyFormat() in its fetch helpers, used to + // detect new-format Supabase API keys) — that string alone is not a leaked secret. + /\bsb_secret_[A-Za-z0-9_-]{20,}\b/, "sk-proj-", "sk-svcacct-", ]; @@ -47,9 +51,10 @@ const offenders = new Map(); for (const file of [...textFiles(publicRoot), ...textFiles(clientBuildRoot)]) { const content = readFileSync(file, "utf8"); for (const marker of forbiddenMarkers) { - if (content.includes(marker)) { + const matchedText = marker instanceof RegExp ? content.match(marker)?.[0] : content.includes(marker) ? marker : null; + if (matchedText) { const relativePath = relative(projectRoot, file).replaceAll("\\", "/"); - offenders.set(`${relativePath}\0${marker}`, { marker, relativePath }); + offenders.set(`${relativePath}\0${matchedText}`, { marker: matchedText, relativePath }); } } } From b236acc4fbfb25a636490958e901cc44bea403d0 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:45:39 +0800 Subject: [PATCH 3/3] =?UTF-8?q?=F0=9F=94=A7=20CodeRabbit=20CI=20Fix:=20Fix?= =?UTF-8?q?=20failing=20GitHub=20Actions=20CI=20checks=20(#972)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- scripts/check-client-bundle-secrets.mjs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/check-client-bundle-secrets.mjs b/scripts/check-client-bundle-secrets.mjs index ede366c1f..3e36b1503 100644 --- a/scripts/check-client-bundle-secrets.mjs +++ b/scripts/check-client-bundle-secrets.mjs @@ -51,7 +51,8 @@ const offenders = new Map(); for (const file of [...textFiles(publicRoot), ...textFiles(clientBuildRoot)]) { const content = readFileSync(file, "utf8"); for (const marker of forbiddenMarkers) { - const matchedText = marker instanceof RegExp ? content.match(marker)?.[0] : content.includes(marker) ? marker : null; + const matchedText = + marker instanceof RegExp ? content.match(marker)?.[0] : content.includes(marker) ? marker : null; if (matchedText) { const relativePath = relative(projectRoot, file).replaceAll("\\", "/"); offenders.set(`${relativePath}\0${matchedText}`, { marker: matchedText, relativePath });