Fix Dependabot and CodeQL security alerts - #189
Merged
Merged
Conversation
Dependencies (npm): bump remotion/@remotion/* to 4.0.523 (drops extract-zip), better-auth, axios, express, multer, react-router 7.x, vite 7.x; refresh transitive deps and add a qs override. pnpm audit now reports 0 findings. Dependencies (pip): upgrade cryptography, pyasn1, starlette/fastapi, urllib3, python-multipart, pydantic-settings, requests, idna, pygments, python-dotenv in backend/uv.lock to their patched versions. CodeQL: - Add express-rate-limit to all user-facing render-server routes (renderer-internal asset proxy and /health intentionally excluded). - Replace the polynomial `^-+|-+$` regex in sanitizeExportFileName. - Add read-only `permissions` block to the lint workflow. Follow-ups from the upgrades: Express 5 typings now allow string[] params (routeParam helper), better-auth needs fromNodeHeaders for getSession, and Remotion's lint rule wants volume callbacks in VideoPlayer. Also clears the pre-commit blockers (prettier on touched files, no-empty catch, ruff SIM117 and mypy unreachable in ai/routes.py).
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 4 |
| Duplication | 63 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
Frontend: - Fix the 7 pre-existing tsc errors: align LeftPanel/ExportPanel/ TrackLabelColumn prop types with the async handlers and Keyframe type they receive, drop the unused `showTabs` prop, type the keyframe track property instead of `any`, and delete the unused MediaBinPage/ MediaBinRoute components that rendered MediaBin without props. - Fix the 2 eslint errors (duplicate import, explicit any) and 5 react-hooks/exhaustive-deps warnings (stable refs/callbacks added to deps; redundant `timeline` dep removed where getAllScrubbers already tracks it). - Run prettier on the 27 files that failed format:check. Backend: ruff format ai/schema.py. tsc, eslint --max-warnings 0, prettier --check, react-router build, ruff check/format and mypy all pass locally.
pnpm/action-setup@v4 errors out when both its `version` input and package.json's `packageManager` field are set, which is why the frontend job has been failing at setup.
robinroy03
added a commit
that referenced
this pull request
Sep 10, 2026
CodeQL flagged the one route left without a limiter after #189. Headless Chrome fetches assets through this route during renders, so it gets a deliberately loose per-IP limit (2000/min) rather than the user-facing ones.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes all open Dependabot alerts (148: 122 npm, 26 pip) and the 15 open CodeQL alerts on
main.Dependencies
npm (
pnpm audit: 0 findings, was 4 critical / 70 high / 49 moderate / 8 low)remotion+ all@remotion/*→ 4.0.523 (critical GHSA-2jqp-f4gr-44fr / GHSA-g6pc-6676-c23j; also drops the unpatchableextract-zipdependency)better-auth→ ^1.7.4,axios→ ^1.20.0,express→ ^5.2.1,multer→ ^2.3.0,react-router/@react-router/*→ ^7.18.3,vite→ ^7.3.6qs >= 6.16.0override; dropped stalebetter-auth/vite/js-yaml/body-parser/qs/tar/minimatchoverrides that are now satisfied directly.express-rate-limit(see CodeQL below).pip (
backend/uv.lock, targeteduv lock --upgrade-package, tooling versions untouched)cryptography50.0.1,pyasn10.6.4,starlette1.6.0 /fastapi0.141.1,urllib32.7.0,python-multipart0.0.32,pydantic-settings2.15.0,requests2.34.2,idna3.19,pygments2.21.0,python-dotenv1.2.3CodeQL
express-rate-limiton every user-facing route inapp/videorender/videorender.ts: 300 req/min for reads/deletes, 60 req/min for uploads, clones and render jobs./healthand the renderer-internal/renderer/assets/:id/fileproxy (hit by headless Chrome during renders) are deliberately excluded.trust proxyset to 1 so limits key on the real client IP behind nginx.sanitizeExportFileNametrims dashes with a loop instead of/^-+|-+$/.permissions: contents: readadded tolint.yml.Required follow-ups from the upgrades
req.paramsvalues asstring | string[]→routeParam()helper.better-auth1.7getSessionneedsfromNodeHeaders(req.headers).@remotion/volume-callbacklint rule → callback-formvolumeinVideoPlayer.tsx.no-empty/ ruff SIM117 / mypy unreachable) blocked the commit on pre-existing issues in touched files, so those are fixed here too. Prettier reformatting accounts for most of thevideorender.tsdiff.CI fixes (second commit)
mainwas already red for both lint jobs. This PR also clears those pre-existing failures so the workflow is green:LeftPanel,ExportPanel,TrackLabelColumnaligned with the async handlers /Keyframetype they receive; unusedshowTabsprop dropped;property as anytyped; unusedMediaBinPage/MediaBinRoute(renderedMediaBinwith no props, not referenced anywhere) deleted.react-hooks/exhaustive-depswarnings.format:check;ruff formatonbackend/ai/schema.py.Verification
pnpm audit→ 0 vulnerabilitiespnpm typecheck,pnpm eslint . --max-warnings 0,pnpm format:check,pnpm buildall passruff check,ruff format --check,mypyall pass