chore: update dependencies and fix security vulnerability#28
chore: update dependencies and fix security vulnerability#28chintan992 wants to merge 7 commits intomainfrom
Conversation
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request systematically updates the project's dependencies to their most recent stable versions, addressing both major library upgrades and minor patches. The update ensures the project benefits from the latest features, performance improvements, and security fixes, while maintaining build integrity and code quality through automated verification steps. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates numerous project dependencies. While most changes are minor version bumps and related formatting adjustments, I've identified two critical issues. First, a change in FireStoreRules.md introduces a syntax error by altering indentation, which will break your Firestore rules deployment. Second, and more importantly, the axios dependency in package.json is updated to a version that doesn't exist on the public npm registry. This poses a significant security risk, potentially indicating a dependency confusion attack, and requires immediate investigation.
| match /databases/{database}/documents { | ||
| // --- Helper Functions --- |
There was a problem hiding this comment.
The match statement and the following comment have been un-indented. This is a syntax error in Firestore security rules, as the match block must be nested within the service block. This change will cause the deployment of security rules to fail. Please restore the correct indentation.
| match /databases/{database}/documents { | |
| // --- Helper Functions --- | |
| match /databases/{database}/documents { | |
| // --- Helper Functions --- |
package.json
Outdated
| "@types/workbox-build": "^5.0.1", | ||
| "axios": "^1.8.4", | ||
| "@types/workbox-build": "^5.1.0", | ||
| "axios": "^1.13.5", |
There was a problem hiding this comment.
The version for axios has been updated to ^1.13.5. This version does not exist on the public npm registry (the latest official version is 1.7.2). The previous version in the diff, ^1.8.4, also appears to be non-existent. This is a major security concern as it could indicate a typosquatting or dependency confusion attack. Please verify the source of this package and use a valid, official version of axios.
There was a problem hiding this comment.
try again i have updated the PR
Deploying letsstream2 with
|
| Latest commit: |
85a405a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://f4ca0416.letsstream2.pages.dev |
| Branch Preview URL: | https://dependency-updates.letsstream2.pages.dev |
chintan992
changed the title
📝 WalkthroughWalkthroughAdds Hexa video-source support and per-link header propagation into the Video.js player; also includes types and API parsing for Hexa, plus various formatting, docs edits, and dependency version upgrades. Changes
sequenceDiagram
participant Client
participant useStreamFlixAPI as StreamFlix API Hook
participant HexaAPI as Hexa Remote API
participant VideoPlayer as VideoJsPlayer
participant VHS as videojs-contrib-hls (VHS)
participant Origin as Media Origin
Client->>useStreamFlixAPI: request streams (movie/tv)
useStreamFlixAPI->>HexaAPI: fetch Hexa Video-source.json / endpoints
HexaAPI-->>useStreamFlixAPI: HexaResponse (streams with headers)
useStreamFlixAPI-->>Client: LabeledStreamLink[] (includes headers)
Client->>VideoPlayer: select link (with headers)
VideoPlayer->>VHS: init tech, set beforeRequest interceptor
VHS->>Origin: XHR for m3u8/segments (interceptor injects link.headers)
Origin-->>VHS: media segments
VHS-->>VideoPlayer: playback
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.qwen/settings.json (1)
4-9:⚠️ Potential issue | 🟠 MajorHardcoded API key detected in version control.
The
CONTEXT7_API_KEYis committed in plaintext. Even if this is a development/test key, secrets should not be stored in version control. Consider:
- Using environment variables or a secrets manager
- Adding this file to
.gitignoreif it contains user-specific secrets- Rotating this key if it has been exposed in public history
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.qwen/settings.json around lines 4 - 9, The settings file contains a hardcoded secret under the "headers" key named CONTEXT7_API_KEY; remove the plaintext value and replace it with a runtime lookup (e.g., read from an environment variable like process.env.CONTEXT7_API_KEY or a secrets manager) wherever "httpUrl"/"headers" are loaded, ensure the committed config contains no real secrets (use a template or placeholder instead), stop tracking the file with git if it must remain local, and rotate the exposed key and purge it from repository history (using git-filter-repo/BFG) after replacing the secret.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@package.json`:
- Line 59: Move the type-only package "@types/workbox-build" out of the
dependencies section and into devDependencies in package.json; update the
package.json so "@types/workbox-build": "^5.1.0" appears under devDependencies
(and is removed from dependencies) to keep type definitions out of runtime
install artifacts.
- Around line 22-25: The package.json still contains the legacy "docusaurus"
(v1) dependency which conflicts with the migrated `@docusaurus/`* v3 packages;
remove the "docusaurus" entry from package.json, then update the lockfile by
running your package manager (npm/yarn/pnpm install) to regenerate
package-lock.json or yarn.lock; verify no code references "docusaurus" remain
and run the build/tests to ensure the `@docusaurus/core`,
`@docusaurus/plugin-content-docs`, `@docusaurus/preset-classic`, and
`@docusaurus/theme-classic` packages work correctly.
- Line 60: The package.json currently pins axios with the semver tilde "axios":
"~1.7.2", which prevents picking up patches that fix multiple CVEs; update the
dependency to a safe range that includes the fixes (e.g., change the version
specifier to "^1.12.0") so npm/yarn will install a version that contains CVE
fixes (reference the "axios" entry in package.json), then run lockfile update
(npm install or yarn install) and commit the updated package.json and lockfile.
---
Outside diff comments:
In @.qwen/settings.json:
- Around line 4-9: The settings file contains a hardcoded secret under the
"headers" key named CONTEXT7_API_KEY; remove the plaintext value and replace it
with a runtime lookup (e.g., read from an environment variable like
process.env.CONTEXT7_API_KEY or a secrets manager) wherever "httpUrl"/"headers"
are loaded, ensure the committed config contains no real secrets (use a template
or placeholder instead), stop tracking the file with git if it must remain
local, and rotate the exposed key and purge it from repository history (using
git-filter-repo/BFG) after replacing the secret.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (9)
.opencode/agents/soul.md.qwen/settings.jsonAPI_DOCS.mdFireStoreRules.mdindex.htmlpackage.jsonsrc/components/ui/badge.tsxsrc/components/ui/button.tsxsrc/contexts/chatbot-context.tsx
| "@docusaurus/core": "^3.9.2", | ||
| "@docusaurus/plugin-content-docs": "^3.9.2", | ||
| "@docusaurus/preset-classic": "^3.9.2", | ||
| "@docusaurus/theme-classic": "^3.9.2", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, check the package.json file to see the docusaurus entries
cat -n package.json | head -100Repository: chintan992/letsstream2
Length of output: 4251
🏁 Script executed:
# Search for docusaurus references in the codebase (excluding lock files)
rg -nP '(^|["'"'"'])docusaurus(["'"'"']|$)' -g '!**/package-lock.json' -g '!**/yarn.lock' -g '!**/pnpm-lock.yaml' --max-count 50Repository: chintan992/letsstream2
Length of output: 110
Remove legacy docusaurus v1 package from dependencies.
The project migrated to @docusaurus/* v3 (lines 22-25), but the legacy docusaurus v1 package remains at line 66 and is not referenced anywhere in the codebase. Removing it eliminates unused dependencies and prevents potential version conflicts.
- "docusaurus": "^1.14.7",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` around lines 22 - 25, The package.json still contains the
legacy "docusaurus" (v1) dependency which conflicts with the migrated
`@docusaurus/`* v3 packages; remove the "docusaurus" entry from package.json, then
update the lockfile by running your package manager (npm/yarn/pnpm install) to
regenerate package-lock.json or yarn.lock; verify no code references
"docusaurus" remain and run the build/tests to ensure the `@docusaurus/core`,
`@docusaurus/plugin-content-docs`, `@docusaurus/preset-classic`, and
`@docusaurus/theme-classic` packages work correctly.
| "@types/video.js": "^7.3.58", | ||
| "@types/workbox-build": "^5.0.1", | ||
| "axios": "^1.8.4", | ||
| "@types/workbox-build": "^5.1.0", |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check the package.json file to see the current structure
cat package.json | head -100Repository: chintan992/letsstream2
Length of output: 3551
🏁 Script executed:
# Search for any imports of workbox-build or `@types/workbox-build` in the codebase
rg -i 'workbox-build|@types/workbox-build' -g '!package-lock.json' -g '!yarn.lock' -g '!pnpm-lock.yaml' --max-count 20Repository: chintan992/letsstream2
Length of output: 476
🏁 Script executed:
# Also check if workbox-build is a regular dependency or dev dependency
cat package.json | grep -A 50 '"dependencies"' | head -60Repository: chintan992/letsstream2
Length of output: 2032
Move @types/workbox-build to devDependencies.
This package is used only for TypeScript type definitions in vite.config.ts (via type-only import) and should not be in runtime dependencies. Keep production dependencies lean by moving type-only packages to devDependencies.
Move from dependencies to devDependencies in package.json.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 59, Move the type-only package "@types/workbox-build"
out of the dependencies section and into devDependencies in package.json; update
the package.json so "@types/workbox-build": "^5.1.0" appears under
devDependencies (and is removed from dependencies) to keep type definitions out
of runtime install artifacts.
| "@types/workbox-build": "^5.0.1", | ||
| "axios": "^1.8.4", | ||
| "@types/workbox-build": "^5.1.0", | ||
| "axios": "~1.7.2", |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
axios 1.7.2 CVE security vulnerabilities advisories
💡 Result:
Axios v1.7.2 is affected by these published CVE advisories:
- CVE-2024-39338 (SSRF) — path-relative URLs can be interpreted as protocol-relative, enabling SSRF in affected versions >= 1.3.2 and <= 1.7.3; fixed in 1.7.4. [1]
- CVE-2025-27152 (SSRF / credential leakage) — when an absolute URL is passed, Axios may ignore
baseURL, potentially enabling SSRF/credential leakage; fixed in 1.8.2. [2] - CVE-2025-58754 (DoS / unbounded memory via
data:URLs in Node.js) —data:scheme handling can decode the full payload into memory, bypassingmaxContentLength/maxBodyLength; affects >= 1.0.0 and < 1.12.0 (so includes 1.7.2); fixed in 1.12.0. [3]
Upgrade guidance: to address all of the above for the 1.x line, upgrade to axios >= 1.12.0 (or newer). [3]
Sources: [1] [2] [3]
🌐 Web query:
npm axios advisories GHSAs 2024 2025 1.7.x
💡 Result:
Security advisories (GitHub Security Advisories / GHSAs) impacting npm axios 1.7.x in 2024–2025:
-
GHSA-8hc4-vh64-cxmj (CVE-2024-39338) — SSRF via URL handling
Affected:>= 1.3.2, <= 1.7.3(so:1.7.0–1.7.3) • Fixed:1.7.4(github.com) -
GHSA-jr5f-v2jv-69x6 (CVE-2025-27152) — Possible SSRF + credential leakage via absolute URLs overriding
baseURL
Affected:>= 1.0.0, < 1.8.2(so: all1.7.x) • Fixed:1.8.2(github.com) -
GHSA-rm8p-cx58-hcvx (CVE-2025-54371) — Withdrawn advisory (transitive
form-dataissue)
Affected:= 1.10.0only (not 1.7.x), and withdrawn Jul 24, 2025 (github.com) -
GHSA-4hjh-wcwx-xvwj (CVE-2025-58754) — DoS via unbounded memory allocation when Node.js adapter processes
data:URLs
Affected:>= 1.0.0, < 1.12.0(so: all1.7.x) • Fixed:1.12.0(github.com)
Citations:
- 1: https://github.com/advisories/GHSA-8hc4-vh64-cxmj?utm_source=openai
- 2: https://github.com/advisories/ghsa-jr5f-v2jv-69x6?utm_source=openai
- 3: https://github.com/advisories/GHSA-rm8p-cx58-hcvx?utm_source=openai
- 4: https://github.com/advisories/GHSA-4hjh-wcwx-xvwj?utm_source=openai
Upgrade axios from 1.7.2 — current version has three active CVEs.
The ~1.7.2 constraint blocks patches for CVE-2024-39338 (fixed 1.7.4), CVE-2025-27152 (fixed 1.8.2), and CVE-2025-58754 (fixed 1.12.0). Change to ^1.12.0 to address all known advisories:
- "axios": "~1.7.2",
+ "axios": "^1.12.0",📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| "axios": "~1.7.2", | |
| "axios": "^1.12.0", |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@package.json` at line 60, The package.json currently pins axios with the
semver tilde "axios": "~1.7.2", which prevents picking up patches that fix
multiple CVEs; update the dependency to a safe range that includes the fixes
(e.g., change the version specifier to "^1.12.0") so npm/yarn will install a
version that contains CVE fixes (reference the "axios" entry in package.json),
then run lockfile update (npm install or yarn install) and commit the updated
package.json and lockfile.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
prompt.md (1)
5-5: Normalize Markdown structure to avoid lint noise.Please add language identifiers to fenced blocks and keep heading levels incremental (the
###heading jumps a level).Also applies to: 21-21, 26-26, 110-110
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@prompt.md` at line 5, Update the Markdown by adding language identifiers to all fenced code blocks (e.g., ```js, ```json) and fix heading levels so they are incremental (remove the unexpected jump at the "###" heading and adjust surrounding headings to maintain proper nesting); apply the same changes to the other affected fenced blocks and heading occurrences called out in the review comment so linting no longer reports style errors.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/components/player/VideoJsPlayer.tsx`:
- Around line 227-254: The VHS interceptor can read stale currentLinkRef.current
because player.src(...) is called before the ref updates; to fix, introduce and
update a dedicated mutable ref (e.g., vhsInterceptorHeadersRef) synchronously
whenever you call player.src(...) or set a new source (where currentLink is
applied), and change the tech.vhs.xhr.beforeRequest handler to read headers from
that vhsInterceptorHeadersRef instead of currentLinkRef.current; update all
places that change the source (the code paths that call player.src(...) or set
currentLink) to synchronously assign vhsInterceptorHeadersRef.current =
currentLink.headers so the interceptor always uses the headers intended for the
immediately-requested manifest/segments.
---
Nitpick comments:
In `@prompt.md`:
- Line 5: Update the Markdown by adding language identifiers to all fenced code
blocks (e.g., ```js, ```json) and fix heading levels so they are incremental
(remove the unexpected jump at the "###" heading and adjust surrounding headings
to maintain proper nesting); apply the same changes to the other affected fenced
blocks and heading occurrences called out in the review comment so linting no
longer reports style errors.
ℹ️ Review info
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
prompt.mdsrc/components/player/VideoJsPlayer.tsxsrc/hooks/use-streamflix-api.tssrc/utils/types.ts
| // Setup VHS interceptor for custom headers if the tech is initialized | ||
| const tech = player.tech({ IWillNotUseThisInPlugins: true }) as any; | ||
| if (tech && tech.vhs && tech.vhs.xhr) { | ||
| const originalBeforeRequest = tech.vhs.xhr.beforeRequest; | ||
| tech.vhs.xhr.beforeRequest = function (options: any) { | ||
| options = originalBeforeRequest | ||
| ? originalBeforeRequest(options) | ||
| : options; | ||
| const currentLink = currentLinkRef.current; | ||
| if (currentLink && currentLink.headers) { | ||
| options.headers = options.headers || {}; | ||
| for (const [key, value] of Object.entries( | ||
| currentLink.headers as Record<string, string> | ||
| )) { | ||
| const lowerKey = key.toLowerCase(); | ||
| // Browsers refuse unsafe headers natively, avoid errors by not setting them | ||
| if ( | ||
| lowerKey !== "origin" && | ||
| lowerKey !== "referer" && | ||
| lowerKey !== "user-agent" | ||
| ) { | ||
| options.headers[key] = value; | ||
| } | ||
| } | ||
| } | ||
| return options; | ||
| }; | ||
| } |
There was a problem hiding this comment.
Header interceptor can apply stale headers on quality change.
The interceptor reads currentLinkRef.current, but quality switching calls player.src(...) before the effect updates that ref. The first manifest/segment request can use the previous link’s headers and fail for header-sensitive sources.
💡 Proposed fix
const handleQualityChange = useCallback(
(index: number) => {
if (!playerRef.current || !links[index]) return;
@@
+ // Keep header source in sync before triggering new network requests
+ currentLinkRef.current = links[index];
setSelectedLinkIndex(index);
setIsQualityOpen(false);
playerRef.current.src({
src: links[index].url,
type: getVideoType(links[index].url),
});🧰 Tools
🪛 GitHub Check: Quality Checks (20.x)
[warning] 231-231:
Unexpected any. Specify a different type
[warning] 228-228:
Unexpected any. Specify a different type
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/components/player/VideoJsPlayer.tsx` around lines 227 - 254, The VHS
interceptor can read stale currentLinkRef.current because player.src(...) is
called before the ref updates; to fix, introduce and update a dedicated mutable
ref (e.g., vhsInterceptorHeadersRef) synchronously whenever you call
player.src(...) or set a new source (where currentLink is applied), and change
the tech.vhs.xhr.beforeRequest handler to read headers from that
vhsInterceptorHeadersRef instead of currentLinkRef.current; update all places
that change the source (the code paths that call player.src(...) or set
currentLink) to synchronously assign vhsInterceptorHeadersRef.current =
currentLink.headers so the interceptor always uses the headers intended for the
immediately-requested manifest/segments.
1 participant
Automated Dependency Updates & Security Fix
This PR contains a comprehensive and incremental update of project dependencies to ensure your platform runs securely and leverages the latest stable features available. After an initial update process, a serious security concern regarding
axioswas manually audited and resolved.🚨 Security Fix: Mitigating Dependency Confusion
^1.13.5/^1.8.4) to the official tracking version^1.7.2. The1.8+or1.13+versions do not exist on the official NPM registry and could have been an attempted dependency confusion attack. The package has been locked to known legitimate versions andnpm audit fixwas re-verified.📝 Major Updates
reactandreact-dom^18.3.1 -> ^19.2.4) along with@types/reactand@types/react-dom.🚀 Minor & Patch Updates
🛡️ Security & Audits
npm audit fixroutine patched 103 vulnerability warnings safely without causing dependency conflicts.✅ Verification
npm run verifycheck was run at each increment.tsc --noEmit).vite build) successfully bundled all assets without breaking changes or errors.To test this branch locally, run
npm installandnpm run devto ensure no caching issues interfere.Summary by CodeRabbit
New Features
Chores
Documentation