Major security upgrades to 25 release - #7909
Open
kanwarujjaval wants to merge 5 commits into
Open
Conversation
Replaced legacy Python scripts with a modular cmdstanpy-based approach for Bayesian AB testing models. Added new endpoints for checking available models and performing tests. Introduced precompiled `.stan` models for 2-8 variants, improved error handling, and enhanced logging and validation mechanisms.
Added compatibility for Ubuntu 24 in A/B testing plugin setup script. Updated npm dependencies in several plugins to resolve vulnerabilities and improve compatibility. Migrated Docker API image to use Node.js 22, upgraded CentOS tools, and replaced deprecated components with newer alternatives for security and stability improvements.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR targets the “25” release hardening effort by upgrading vulnerable dependency chains, rebuilding Docker images to reduce shipped attack surface, and replacing the hooks custom-code sandbox implementation to eliminate unintended network/process capabilities.
Changes:
- Upgraded multiple vulnerable transitive dependencies via npm
overridesacross core and plugin packages (e.g., tar, form-data, protobufjs, websocket-driver, brace-expansion). - Rebuilt API and frontend Docker images as multi-stage builds on newer base images (Debian trixie + Node 24) and updated Node versions in other build targets.
- Replaced
v8-sandboxwithisolated-vmforCustomCodeEffect, plus updated related hooks dependencies/lockfiles and SSRF tests.
Reviewed changes
Copilot reviewed 13 out of 18 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| plugins/push/package.json | Adds/updates npm overrides for push plugin transitive dependency hardening. |
| plugins/push/package-lock.json | Lockfile updates aligning push plugin to upgraded protobufjs/form-data/websocket-driver. |
| plugins/plugins/package.json | Adds central overrides for the plugins manager package. |
| plugins/hooks/tests/ssrf.js | Removes prior CustomCodeEffect HTTP-surface regression test while keeping HTTPEffect SSRF tests. |
| plugins/hooks/package.json | Swaps hooks custom-code dependency from v8-sandbox to isolated-vm; adds overrides. |
| plugins/hooks/package-lock.json | Regenerates lockfile for hooks plugin with isolated-vm dependency tree. |
| plugins/hooks/api/parts/effects/custom_code.js | Reimplements CustomCodeEffect execution using isolated-vm. |
| package.json | Expands root overrides to address vulnerable transitive dependencies. |
| package-lock.json | Updates root lockfile to reflect upgraded dependency graph (tar/body-parser/etc.). |
| Dockerfile-frontend | Reworks frontend image into multi-stage build on Node 24 trixie; adjusts build/runtime deps. |
| Dockerfile-core | Updates NodeSource setup from 20.x to 22.x for the core build image. |
| Dockerfile-centos-frontend | Updates CentOS frontend build to NodeSource 22.x and adds toolchain support for isolated-vm builds. |
| Dockerfile-centos-api | Updates CentOS API build to NodeSource 22.x and adds toolchain support for isolated-vm builds. |
| Dockerfile-api | Reworks API image into multi-stage build, including ab-testing model build stage and slimmer runtime. |
| CHANGELOG.md | Adds release notes for 25.03.52 security/dependency/docker/sandbox changes. |
| bin/docker/preinstall.sh | Makes plugin install and asset build failures fail the image build with clearer errors. |
| bin/docker/modify.sh | Adjusts ab-testing model build logic to skip when prebuilt/disabled and to use cmdstanpy flow. |
| api/utils/utils.js | Restores legacy decrypt compatibility on Node 22+ by replacing removed crypto.createDecipher behavior. |
Files not reviewed (2)
- plugins/hooks/package-lock.json: Generated file
- plugins/push/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
kanwarujjaval
added
do-not-review
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Upgraded Node.js from version 20 to 22 across scripts, Dockerfiles, and dependencies. Enhanced RHEL 8 compatibility with GCC toolset-11 and Python 3.8 for building isolated-vm. Removed legacy utilities, deprecated APIs, and unnecessary npm overrides. Consolidated AB testing and Docker API image improvements for enhanced security and reliability. Added new test scripts and fixed sandbox-related issues in the Hooks plugin.
…sandbox test Adjusted `buildHookConfig` and `testHookURL` to ensure the mock request's paths match the trigger configuration path, resolving inconsistencies in the test setup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.