* fix(deps): bump fast-uri to patch host-confusion SSRF vulnerabilities
fast-uri <3.1.5 is vulnerable to host confusion via backslash authority
delimiters and failed IDN canonicalization (GHSA advisories), which can
enable SSRF. ajv and @rjsf/utils already permit fast-uri ^3.x, so this
only required refreshing the lockfile resolution, no parent bump needed.
* fix(deps): bump undici to patch cookie/cache/desync vulnerabilities
undici <7.29.0 is affected by several advisories: Set-Cookie SameSite
downgrade via permissive substring matching, cross-user cache leakage
via whitespace bypass, downstream response desync via retry
interceptor, CRLF injection via blob-like body 'type', and cookie
attribute injection via unsanitized domain fields. The direct
dependency's existing ^7.25.0 range already permitted the fix, so this
only required refreshing the lockfile resolution.
Note: @connectrpc/connect-node@1.7.0 still bundles its own pinned
undici@^5.28.4 (resolves to 5.29.0), which remains vulnerable to the
older <6.24.0 advisories. Fixing that requires a major bump of
connect-node to 2.x, which needs its own review for breaking API
changes - tracked as a follow-up.
* fix(deps): bump builder-util-runtime to patch credential-leak vulnerability
builder-util-runtime <9.7.0 leaks PRIVATE-TOKEN and mixed-case
Authorization credentials on cross-origin redirects during
electron-updater's auto-update flow. electron-builder and
electron-builder-squirrel-windows pinned it exactly at 9.5.1, so
those parents needed bumping (26.8.1 -> 26.15.7) to pull the fix.
electron-updater's existing ^6.6.2 range already permitted 6.8.9,
which resolves the same fixed builder-util-runtime.
* fix(deps): bump liquidjs to patch memoryLimit bypass
liquidjs <=10.27.0's pop filter bypasses the memoryLimit accounting
enforced by its array-filter siblings, allowing a DoS via unbounded
memory growth in template rendering. Both consumers already declare
^10.27.0, which permits the fix, so this only required a lockfile
refresh (resolved to 10.28.0).
* fix(deps): bump ip-address to patch octal/decimal parsing SSRF
ip-address <=10.3.0 decodes Address4 leading-zero octets as decimal
while WHATWG URL host parsing, inet_aton, and getaddrinfo decode them
as octal, letting an attacker bypass IP-based trust boundaries and
achieve SSRF. express-rate-limit@8.3.2 pinned ip-address at an exact
10.1.0, so it needed bumping to 8.6.2 (still within @modelcontextprotocol/sdk's
^8.2.1 range) which declares ip-address ^10.2.0 and resolves to 10.4.0.
* fix(deps): bump tar to patch PAX parsing and recursion DoS issues
tar <=7.5.20 has multiple issues: process crash via PAX numeric path
type confusion, decompression/parse DoS via unlimited input, infinite
loop on negative entry size during archive replace, uncaught exception
via NUL bytes in PAX path/linkpath records, and uncontrolled recursion
in mapHas/filesFilter enabling stack-overflow DoS via crafted long-path
entries. node-gyp and @mapbox/node-pre-gyp already declare tar ^7.5.4 /
^7.4.0, which permit the fix, so this only required a lockfile refresh
(resolved to 7.5.22).
* fix(deps): bump ws to patch tiny-fragment memory exhaustion DoS
ws 8.0.0-8.20.1 bounds retained WebSocket message fragments via
maxFragments/maxBufferedChunks, but the defaults were set too high,
letting an attacker exhaust memory with many tiny fragments/chunks.
The direct ws dependency's ^8.18.1 range already permitted the fix;
socket.io/socket.io-client's bundled engine.io, engine.io-client, and
socket.io-adapter pinned ws with a `~8.20.1` tilde range that excluded
it, so those three needed bumping to pull in `~8.21.0` (still within
socket.io@4.8.3's own ~6.6.0/~6.6.1 ranges). All ws instances now
resolve to 8.21.2.
* fix(deps): bump hono to patch 33 advisories (cookie/CORS/routing/XSS)
hono <=4.12.33 accumulates a long list of fixes: cookie name validation
bypass on write/read paths, path traversal in toSSG() and serve-static
(including Windows backslash encoding), IP restriction bypass for
IPv4-mapped/non-canonical IPv6, JWT NumericDate/Bearer-scheme
validation gaps, cache middleware Vary header leakage, CORS wildcard
credential reflection, JSX SSR XSS via cx(), and a ReDoS in CORS's
Access-Control-Request-Headers handling, among others.
@modelcontextprotocol/sdk's existing ^1.17.5 range already permits
the fix; bumping it to 1.30.0 resolves hono to 4.13.0.
* fix(deps): bump valibot to patch flatten() TypeError on inherited keys
valibot <=1.4.1's flatten() helper throws a TypeError when validation
issues contain attacker-controlled object keys such as toString,
valueOf, or hasOwnProperty. @react-router/dev's existing ^1.2.0 range
already permits the fix, so this only required a lockfile refresh.
* fix(deps): bump dompurify to 3.4.13 (direct dep, lockfile refresh)
Direct dependency's existing ^3.4.10 range already permitted the fix;
this only required a lockfile refresh.
* fix(deps): bump morgan to 1.11.0 (transitive via @react-router/serve)
@react-router/serve@7.15.0's existing ^1.10.1 range already permitted
the fix, so this only required a lockfile refresh. Brings on-finished
along from ~2.3.0 to ~2.4.1 as a nested dependency bump.
* fix(deps): bump uuid from v9 to v11 to patch buffer bounds check
uuid <11.1.1 is missing a buffer bounds check in v3/v5/v6 when a buf
is provided, which can lead to memory corruption. insomnia-data,
insomnia-scripting-environment, and insomnia-smoke-test were still on
^9.0.1 (packages/insomnia already used ^11.1.1). This is a major
version bump, but the only APIs in use across these packages are v4()
and validate(), whose signatures are unchanged between v9 and v11, so
no code changes were needed. All three now resolve to uuid@11.1.1.
* fix(deps): bump csv-parse from v6 to v7
csv-parse 6.x is flagged for update to 7.0.2. This is a major version
bump (ESM/CJS dual-package modernization), but the sync `parse()` API
that packages/insomnia-scripting-environment and the sandbox's
require-interceptor (exposing it to user scripts as
'csv-parse/lib/sync') both rely on is unchanged - verified with an
identical before/after parse() smoke test. No code changes needed.
* fix(deps): bump react-router family to 7.18.2 to patch CSRF/XSS/DoS advisories
react-router 6.0.0-7.18.0 accumulates several advisories: CSRF via
PUT/PATCH/DELETE document requests, open redirect via backslash in
<Link>/useNavigate, RSCErrorHandler missing protocol validation (XSS),
arbitrary constructor injection via deserializeErrors() in SSR
hydration, and unauthenticated DoS via inefficient route matching.
react-router, @react-router/dev, @react-router/fs-routes,
@react-router/node, and @react-router/serve were all exact-pinned at
7.15.0 and needed bumping together (they're a version-locked family)
to 7.18.2 - a non-major fix version per npm audit.
One additional react-router advisory (RSC Mode CSRF Bypass, fixed only
in 8.3.0+) doesn't apply here: this app doesn't use React Server
Components (no react-server-dom-webpack/@vitejs/plugin-rsc usage in
the codebase), so the RSC-specific code path is never exercised.
As a side effect, @react-router/serve's bundled express moved from
4.22.1 to 4.22.2, which also fixes a body-parser DoS advisory
(silently-disabled size limit on invalid `limit` values) for that one
instance. Two other body-parser instances (smoke-test's own express,
and the MCP SDK's bundled express) remain on vulnerable body-parser
versions - tracked as a follow-up.
* fix(deps): bump socket.io-parser to patch zero-attachment memory exhaustion
socket.io-parser 4.0.0-4.2.6 lets a specially crafted packet make the
server wait for a large number of binary attachments and buffer them,
exhausting memory. socket.io@4.8.3's existing ~4.2.4 range already
permitted the fix, so this only required a lockfile refresh.
* fix(deps): bump body-parser (via smoke-test's express) to patch limit-bypass DoS
body-parser <1.20.6 silently disables its size-limit enforcement when
given an invalid `limit` value, allowing a DoS via unbounded request
bodies. insomnia-smoke-test's express (^4.21.2) already permitted the
fix; bumping it to 4.22.2 resolves body-parser to 1.20.6.
Note: @modelcontextprotocol/sdk still bundles express@5.2.1 with a
vulnerable body-parser@2.2.2 (needs >=2.3.0). Left unfixed for now -
Insomnia only uses the SDK's client-side StreamableHTTPClientTransport
(packages/insomnia/src/main/mcp/transport-streamable-http.ts), never
the SDK's server/express code path, so this instance is unreachable
in practice. A prior attempt to patch it via manual lockfile surgery
left package-lock.json in an inconsistent state (a resolved package
missing its "packages" entry, so `npm ci` wouldn't reproduce it) and
was reverted. Tracked as a follow-up to fix through a supported
mechanism (e.g. once @modelcontextprotocol/sdk relaxes its body-parser
range, or via a clean full lockfile regeneration reviewed on its own).
* fix(deps): bump form-data to patch CRLF injection (2 of 3 instances)
form-data <2.5.6 and >=4.0.0 <4.0.6 are vulnerable to CRLF injection
via unescaped multipart field names/filenames. @types/request's
^2.5.5 and jsdom's ^4.0.0 ranges already permitted the fix, resolving
to 2.5.6 and 4.0.6 respectively via lockfile refresh.
Note: httpsnippet@3.0.10 (the latest available release) exactly pins
form-data at 4.0.4, which stays vulnerable. There's no newer
httpsnippet version to bump to yet - this is upstream-blocked, not
fixable without an override. Tracked as a follow-up to revisit once
httpsnippet ships a fix.
* fix(deps): bump @customerio/cdp-analytics-browser to patch nested js-cookie + uuid
Bumps the pinned ^0.3.9 to ^0.5.9. This single bump fixes two
findings that were previously nested inside this analytics SDK and
not independently reachable:
- js-cookie: was exactly pinned at 3.0.1 (<=3.0.5 is vulnerable to a
per-instance prototype hijack in assign() enabling cookie-attribute
injection); now ^3.0.7, resolving to 3.0.8.
- uuid: customerio-gist-web bundled uuid@^8.3.2 (missing buffer bounds
check in v3/v5/v6, <11.1.1); now declares ^14.0.0, resolving to
14.0.1. This was the residual instance noted as a follow-up in the
earlier uuid v9->v11 commit.
The AnalyticsBrowser API surface used in use-cio.tsx (load/track/
identify/page/reset) is unchanged between 0.3.19 and 0.5.9.
* fix(deps): bump body-parser to 2.3.0 for the MCP SDK's bundled express
Fixes the remaining body-parser instance (via @modelcontextprotocol/sdk's
express@5.2.1, which declares ^2.2.1 - already permitted the fix).
This is the instance noted as unreachable/deferred in the prior
body-parser commit; the dependency graph has since shifted (from the
react-router and customerio bumps) enough that a plain `npm update
body-parser` now resolves it cleanly via a proper lockfile entry,
unlike the earlier attempt that left a broken lockfile via manual
surgery. All three body-parser instances are now fixed.
* feat: record enterprise-plan actions for request/document creation
* chore: address copilot feedback
* feat: adds enterprise plan type guard
* chore: formatting
* refactor: clean up
* chore: use proper types
* refactor: clean up
* chore: clean up
* add package
remove workspaceCount from rootLoaderData
move unrelevant loaders out
add query context
adapt tanstack query
fix som issues
add new ways to load data
initial changes
clean code
remove and fix code
add a method to get organization data in main
refine the way to get data from tanstack
fix issue
fix issues
fix duplicate calling issue
fix unsubscribe issue
fix merge issue
fix listen issue
fix find organization issue for workspace
support workspatemeta in tanstack query
update types
move logic to insomnia-data services
remove things
change to use service
fix the loader bug
remove a file
fix type issues
refine code for workspace-children
change style import
fix main type issue
fix type issue
fix data fetching
fix delete project issue
cache the sidebar data in main
add unit tests
update cache and cache service
fix issues from comment
revert organization change
fix issues from comment
fix test failures
fix test failures
add comments and refine way to get workspace children
fix dedup and import issue
remove useless code
add duplicate id check
fix type failures
fix mock server issue
resolve conflict
1.remove main process cache
add renderer level app data
fix issues
* fix issues from review
* perf: rewrite command palette search to eliminate UI freezes and stale results
Problems fixed:
- clientLoader blocked navigation on every palette open, freezing the UI during
full sequential DB scan
- no AbortController: stale searches could overwrite newer results mid-type
- no debounce: every keystroke triggered a full DB traversal immediately
- React Aria's default contains filter re-filtered server-side fuzzy results,
silently dropping valid matches and making fuzzy work redundant
- no warm baseline: palette started blank until the entire load completed
Changes:
- move fuzzyMatch/fuzzyMatchAll → insomnia-data/common-src/search.ts (shared,
testable in node)
- move search logic → insomnia-data/node-src/services/helpers/command-search.ts
- per-request AbortController cancellation via abort(requestId)
- recursion depth guard (max 20) on request group traversal
- safeParent() replaces non-null assertions, safe against orphaned documents
- add CommandSearchResult type in insomnia-data/src/command-search-types.ts
- add useCommandSearch hook: 250ms debounce + abort on filter change + warm
baseline on mount
- add defaultFilter={() => true} to ComboBox, delegating all filtering to the
service
- delete routes/commands.tsx
* fix
* fix
* Create new methods colors
* Implement first request logic
* feat: enhance first request treatment logic with backend support and caching
* feat: add experiment assignment analytics and related utility functions
* feat: add reportRequestsCreated function to track request creation for first-request experiments
* feat: enhance request creation reporting with session tracking
* feat: add tests for reportRequestsCreated function to validate API interactions
* feat: refactor localStorage methods for better error handling and state management
* feat: enhance accessibility of error message in FirstRequestCreation component
* feat: simplify user ownership check in project component
* feat: update user tests to include onboarding state and related functions
* feat: replace reportRequestCreated function with maybeLatchRequestThreshold for request tracking
* feat: integrate onboarding state into first request treatment logic and refactor related functions
* feat: integrate onboarding state into FirstRequestCreation component and enhance treatment logic
* feat: implement maybeLatchRequestThreshold function for tracking first-request graduation
* feat: refactor onboarding request handling and replace reportRequestsCreated with latchRequestThresholdReached
* feat: simplify first request treatment logic and remove unused functions
* feat: update latchRequestThresholdReached to use PATCH method for idempotent threshold latch
* feat: update onboarding state interface and test to use reached_request_threshold instead of has_reached_request_threshold
* feat: update latchRequestThresholdReached to use PUT method and correct endpoint for idempotent threshold latch
* feat: remove reached_request_threshold from onboarding state and related tests
* feat: integrate request tracking with maybeLatchRequestThreshold in clientAction
* feat: update onboarding state handling and treatment logic in user module
* feat: update @getinsomnia/insomnia-v3-fetch to version 1.0.20 in package-lock and package.json
* feat: add padding to request URL bar and adjust MethodSelector alignment
* feat: enhance request threshold handling by adding per-account request count baseline
* feat: update analytics event emission for treatment assignments in first request flow
* feat(templating): PoC run plugin template tags in a QuickJS-WASM sandbox
Behind a new `templateTagSandboxEnabled` setting (default off), route plugin
template-tag execution through a QuickJS-WASM sandbox instead of invoking the
plugin's `run()` directly in the main process.
Approach (per PR #10072): bulk-copy render state into the sandbox as JSON,
rebuild the plugin `context` API in pure JS inside the sandbox, and bridge only
async work back to the host via the existing `pluginToMainAPI` handlers.
`node:crypto` is exposed as synchronous host functions so `require('crypto')`
works without a sync/async mismatch.
- templating/sandbox/: quickjs-runtime, marshal, host-bridge, in-sandbox-bootstrap,
plugin-tag-sandbox (+ parity tests vs in-process tags and node:crypto)
- main/templating-worker-database.ts: route execute handlers through the sandbox
when the flag is on; legacy path unchanged otherwise
- esbuild: keep quickjs-emscripten external so its .wasm resolves at runtime
- settings + scripting-settings UI toggle
- examples/insomnia-plugin-sandbox-demo: manual E2E fixture
Scope: template tags only; sandbox runs in main. require shim covers path + crypto
(other modules throw a clear error — follow-up work).
* test(smoke): e2e canary for the template-tag sandbox flag
Installs an inline probe plugin, renders its tags via the tag editor Live
Preview, and asserts the execution path flips main-process -> sandbox when
templateTagSandboxEnabled is toggled in Preferences > Scripting, with a
require('crypto') sha256 workload staying byte-identical across both paths.
* test(sandbox): suppress hardcoded-hmac-key semgrep finding on parity fixture
The HMAC key is a test vector for sandbox-vs-node:crypto parity, not a
credential; rename it to make that self-evident and add the repo-standard
nosemgrep suppression.
* fix(templating): contain sandbox plugin entry resolution to the plugin directory
Reject a package.json "main" that resolves outside the plugin's own folder
and bundled-plugin names that look like paths, so the sandbox source loader
cannot be steered into reading arbitrary files.
* fix(review): inline nosemgrep placement, plugin-load error context, cross-arch-safe canary
- Move the hardcoded-hmac-key suppression onto the flagged line (line-above
placement was not honored by the scanner).
- Wrap getPluginEntrySource failures with the plugin name for diagnosability.
- Derive the canary's expected arch from the Electron main process instead of
the Playwright runner so cross-arch setups can't flake the assertion.
* sec(templating): QuickJS template-tag sandbox additions (#10209)
* fix(sandbox): enforce timeout on synchronous plugin loops
QuickJS's executePendingJobs() blocks the host thread until a synchronous
call returns, so the wall-clock deadline in drivePromiseToString was never
checked during a tight sync loop in plugin code, hanging the Electron main
process indefinitely. Add a QuickJS interrupt handler, which is polled
during synchronous execution, to enforce the deadline.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): clamp crypto.randomBytes size to prevent OOM
hostCrypto.randomBytes(size) passed the sandboxed number straight to
Node's crypto.randomBytes with no upper bound, letting a plugin request
a multi-GB allocation (e.g. crypto.randomBytes(2 ** 31)) and crash the
host process. Clamp to 64KB before the call.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): cap QuickJS heap to prevent unbounded allocation
QuickJS.newContext() had no memory limit, so a plugin allocating without
bound could exhaust the WASM heap and crash the host process. Set a 32MB
ceiling via ctx.runtime.setMemoryLimit().
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): resolve symlinks before validating plugin entry path
getPluginEntrySource's containment check compared raw path strings, so a
plugin directory with a symlinked entry (e.g. index.js -> ../../../etc/secret)
passed the check while fs.readFileSync followed the symlink and read the
out-of-directory target. Re-run the check against fs.realpathSync'd paths.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): close util.render sandbox escape
context.util.render() bridged to the shared render() pipeline, whose Liquid
engine dispatches any registered tag's real run() directly, in-process,
regardless of templateTagSandboxEnabled. A sandboxed plugin could hand it a
string containing "{% anyTag %}" (including its own tag) and have that tag
execute completely unsandboxed. Verified with a PoC that reached
child_process execution from inside a plugin tag with no require() or Node
access.
util.render is now restricted to plain {{ variable }} interpolation (the
only real existing use, confirmed against all built-in tag call sites) via
a second Liquid engine with no tags registered; {% tag %} syntax now fails
to parse instead of dispatching. Default render() behavior is unchanged for
every other caller.
Also drops the dead renderDepth field's misleading doc comment: within one
sandboxed execution the envelope's renderDepth is always 0, so depth could
never exceed 1 regardless of enforcement — it couldn't have caught this
recursion anyway.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(sandbox): fixed linting issue
* fix(sandbox): fixed linting issue
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---------
Co-authored-by: kwburns-kong <kyle.burns@konghq.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Add vault-crypto/mime utilities and remove heavyweight third-party imports
- Add AES-GCM vault-crypto utility with tests (replaces node-forge usage)
- Add common/mime.ts to replace mime-types package dependency
- Replace tough-cookie import in response-cookies-viewer with inline parser
- Replace @grpc/grpc-js status import in grpc-status-tag with inline constant
- Replace electron.ipcRenderer in auth.clear-vault-key with showToast()
- Remove unused analytics call from window-utils
* Fix impure Date.now() key on CodeEditor; use setValue via ref instead
Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet)
whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.
* fix: address Copilot review comments on PR #9992
- vault-crypto: replace forge-in-renderer with IPC bridge (main process
retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue)
- mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx,
fonts, audio/video, etc.) and fix remaining mime-types import in send route
- response-viewer: move charset alias map to module level; normalise iconv-lite
alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder
- auth.clear-vault-key: fix typo "all you local" → "all your local"
* fix: sort imports in send route
* feat: disable nodeIntegration in renderer mainWindow, remove import check tooling
- Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences
(hidden window keeps nodeIntegration:true for user script execution)
- Split script-security-rules.ts out of script-security-policy.ts so the renderer
can import display-only constants without pulling in require-interceptor
- Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions;
update all renderer callers to import from it instead of templating/index
- Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts
so generate() has no Node imports; expose generateToFile from new entry point
- Move runTests execution to main process via IPC (run-tests channel) so the
renderer routes no longer import the Mocha-backed test runner directly
- Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts,
renderer-node-import-baseline.json and all related scripts/plugins now that the
renderer bundle is free of Node built-in imports
* fix: sort imports, use static TestResults type, remove unused analytics import
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* remove mime stuff
* remove ci step
* update plan
* insomnia testing adapter
* use export method
* trick react router ssr
* add renderer errors
* globalThis
* improve error
* move plugin types
* ipc validate proto
* fix import
* plugin types
* polyfill events for jshint
* restore node require plugin
* vault adapter
* add crypto bridges
* tough-cookie ipc
* util stub
* split cookie into network adapter
* assert
* fix plugin index import
* serialise cookie
* decouple renderer from scripting
* Fix rebase conflicts and import path issues
- Fix incorrect ~/insomnia-data imports (should be insomnia-data package)
- Remove non-existent mime utility imports and provide simple fallback
- Remove incorrect analytics call from main process
- Remove unused imports (Settings, Cookie)
- Fix Response type annotation for getResponseBodyBuffer
* lint
* fix tests
* fix: use dynamic import for crypt in session.ts for main process compatibility
The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES().
Changes:
- Use dynamic import of crypt module (only loaded in main process context)
- In renderer: window.main.crypt is always available so dynamic import never executes
- In main process: dynamic import loads crypt with node:crypto support
- Protect loginStateChange() calls with window existence checks
This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts.
Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration.
* fix: add aria-label to template tag preview and browser-safe encoding fallback
- Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility
- Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available
- Fixes smoke test element discovery for template tag preview modal
* fix: add explicit waits for element stability in environment test
Add toBeEnabled() and toBeVisible() waits before clicking elements in the
'kv pair environment can be updated' test. This prevents timeout errors from
unstable/flickering elements during modal interactions, especially in
high-concurrency shard execution.
* remove unused
* add autocomplete generate test step
* fix lint
* put analytics back in
* combine vault and crypto adapter
* remove unused export split
* remove insomnia-testing cruft, addressing feedback
* fix: use direct imports in insomnia-inso after insomnia-testing index.ts removal
* fix circular reference
* fix: move createElectronNotifier to main process to fix SSR error
Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts
to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.
* export har ipc bridge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Move insomnia-data models, services, database code, and common utilities into a dedicated workspace package. Update consumers to import from the new package entrypoints and declare workspace dependencies for the extracted package.
* feat(nunjucks): Swapped templating engine from Nunjucks to liquidJS
* fix: resolved circular references and linting issue
* fix: updated baseline with new naming schema, no new imports introduced.
* fix: patch for playwright test (6/6)
* fix(smoke): handle multi-collection import in importFixture without timing out
* fix(smoke): ensure correct env selected before table edit
* feat: adds functionality to lint specs with a user uploaded spectral ruleset file [INS-2338]
Co-authored-by: Copilot <copilot@github.com>
* chore: update var name
Co-authored-by: Copilot <copilot@github.com>
* chore: remove log
* feat: adds logic to persist rulesetFilePath
* feat: adds logic to remove a uploaded ruleset file and use default OAS ruleset
* feat: adds logic to clean up old ruleset file watcher
* chore: adds comment for testing
* chore: adds comment for clarity
* feat: adds logic to enable cunstom lint rules for cloud/git sync projects
Co-authored-by: Copilot <copilot@github.com>
* chore: remove file watcher for now
* chore: remove file watcher for now
Co-authored-by: Copilot <copilot@github.com>
* feat: adds proper logic to handle syncing rulesets for git sync/cloud sync projects
* chore: remove unneeded event
* feat: auto open up the lint pane if there are lint warnings/errors
Co-authored-by: Copilot <copilot@github.com>
* chore: update ApiSpec mutations to include rulesetContent as optional field; change from FormData to JSON
* feat: uses clientAction mutation hook to update db
* chore: adds logic to handle file not found
* feat: removes .spectral.yaml file name restriction
Co-authored-by: Copilot <copilot@github.com>
* chore: remove comment
* feat: adds some utils to validate user provided spectral ruleset file
Co-authored-by: Copilot <copilot@github.com>
* feat: adds view ruleset modal; slight refactoring to clean up code
Co-authored-by: Copilot <copilot@github.com>
* feat: fixes some styling
* chore: adds some comments
* chore: change function names/clean up
* feat: adds logic to flatten extended rulesets into inline prior to writing to disk
* chore: update comment
* chore: clean up
* chore: update comment
* chore: more comments
* chore: remove comment
* refactor: clean up code to make it more readable
* feat: address double writes when uploading
* chore: update comments/error messages
* chore: update comment
* test: adds unit tests for spectral ruleset validator
* test: adds unit tests for spectral ruleset validator
* test: add unit tests
* chore: cleanup code
* chore: make comments much clearer
* feat: adds proper error messages when user attempts to upload a rule set with severity tuples in extends
* feat: adds UI tweaks
* test: adds unit tests
* feat: adds proper logic to handle scenarios when file does not exist when syncing
* feat: adds proper logic to handle scenarios when file does not exist when syncing
* chore: sight clean up
* chore: bring back old code
* feat: adds logic to migrate rulesets when changing project types
* chore: update some styles
* chore: adds more styling changes
* chore: more styling updates
* feat: adds the ruleset to project scope instead of work space so git <> cloud can be compatible
* feat: adds functionality to get syncing project scoped rulesets working on cloud projects
* feat: adds logic to sync git FS/DB for project ruleset
* chore: refactor to use nedb as source of truth for rulesetContent for all projects.
* feat: adds logic to mitigate against repo replacing cloud project ruleset when migrating from cloud -> git project types
* chore: fixes imports order
* test: fixes e2e test
* fix: resolve aikido security suggestions
* chore: attempt to fix SSRF dns resolve
* chore: update error messages
* test: update tests
* chore: move helpers to common so inso can use them
* feat: adds functionality to flatten remote urls in spectral extends
* test: update tests
* feat: adds logic to validate remote extends before passing ruleset to spectral
* fix: set canDuplicate to false on the ProjectLintRuleset model
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* test: adds more test cases for verifying remote extends validations
* test: adds more test cases for verifying remote extends validations
* chore: disallow redirects when fetching in spectral resolver
* chore: adds aria labels for a11y
* chore: small clean ups
* test: update test
* feat: adds tooltip verbage to let user know that local file paths are flattened
* chore: address PR comments
* chore: address PR comments
* test: update unit test
* chore: address more PR feedback
* feat: adds ruleset file size restriction
* fix: address issue with git repo .spectral.yaml content overwriting the rulesetContent from cloud sync project when going from cloud -> git
* chore: remove unneeded function
* feat: adds segment event
* fix: adds logic to handle scenario where changing project type from cloud -> git would silently overwrite the cloud ruleset with the git one
* chore: typo
---------
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Alison Sabuwala <alison.sabuwala1024@gmail.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* updated plan
* feat: lift network.ts fs/path use behind window.main.timeline IPC bridge
Removes `node:fs` and `node:path` from the renderer-reachable
`src/network/network.ts`. Three timeline-path constructions and two
`appendFile` calls are replaced with narrow `window.main.timeline.getPath`
(sync IPC) and `window.main.timeline.appendToFile` (async IPC) helpers
that live in main, where Node builtins belong.
Path validation in `appendToTimeline` mirrors `writeResponseBodyToFile`:
only paths inside the `responses/` directory ending in `.timeline` are
accepted, preventing a compromised renderer from writing arbitrary files.
Updates `config/renderer-node-import-baseline.json` to remove the two
`src/network/network.ts` entries — the baseline shrinks as intended.
Part of the nodeIntegration: false migration (PR B).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: address Aikido path-traversal feedback and mock window.main in network tests
- `getTimelinePath`: use `path.resolve` + `path.relative` check instead of
`path.join` to prevent path-traversal attacks (Aikido medium severity finding)
- `network.test.ts`: add `vi.stubGlobal('window', ...)` mock for
`window.main.timeline` so tests don't throw "window is not defined" now
that `defaultSendActionRuntime` calls `window.main.timeline.appendToFile`
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* chore: suppress echoServer stdout in playwright config
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: update insomnia-inso logger for consola v3 compatibility
FancyReporter and BasicReporter were removed in consola v3; LogLevel became
a type-only export and the runtime enum is now LogLevels. Replace with
createConsola + a local BasicReporter shim, and import LogLevels in cli.ts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: address timeline IPC review concerns
- Convert timeline.getPath from sendSync to invoke (async) to avoid
blocking the renderer thread; path construction has no I/O
- Extract getResponsesDir() shared helper so both getTimelinePath and
appendToTimeline read the same source of truth, eliminating env-drift
between the two calls
- Guard mkdir with a Set so the responses directory is only created once
per process rather than on every appendFile call
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: upgrade consola to v3 and fix type/import issues in insomnia-inso
- Bump consola from ^2.15.3 to ^3.4.2 to match logger.ts which already used v3 API (createConsola)
- Fix logType → LogType (renamed in v3)
- Remove fancy option (removed in v3 ConsolaOptions)
- Use ConsolaInstance instead of Consola in result-report.ts so .log() resolves correctly
- Fix import sort in cli.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: restore Node.js-safe fallbacks in network.ts for inso CLI
The timeline IPC bridge introduced window.main.timeline calls without
guarding against the inso CLI context where window is not defined.
The electron shim (aliased in the inso bundle) provides app.getPath
as a fallback, matching the pre-bridge behaviour.
- getTimelinePath: check typeof window before using IPC; fall back to
the electron shim path (os.tmpdir()/insomnia-send-request/responses)
- defaultSendActionRuntime.appendTimeline: fall back to fs.promises.appendFile
- tryToExecutePreRequestScript catch block: skip IPC appendToFile in
Node.js context
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: sort node: imports before third-party and replace if/else with ternary in network.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: replace static fs/path imports with inline require() to pass renderer baseline check
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor: replace process.type branching in network.ts with build-time adapter modules
Eliminates all runtime process.type and typeof window checks by introducing
network-adapter.renderer.ts and network-adapter.node.ts. Vite and Vitest resolve
the import to the renderer adapter; inso esbuild resolves to the node adapter.
No branching code remains in network.ts itself.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: restore object alias format in vite.config.ts to fix rollup build
Array-form alias with find:'~' was not matching prefix imports like
~/common/insomnia-fetch in the react-router production build. Object
form behaves correctly in Vite 7.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: resolve merge conflicts in logger.ts and cli.ts, restore AGENTS.md indented tree
- logger.ts: keep LogType (consola v3 casing), drop duplicate conflict markers
- cli.ts: remove stashed duplicate LogLevels import from conflict block
- AGENTS.md: restore indented hierarchy in Repository Structure and Data Model sections
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* remove cx
* fix: add path traversal guard to getTimelinePath in node adapter
Mirrors the same defence-in-depth check already present in the IPC handler.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix tests which use network from main
* flake
* refactor: replace bundler aliases with process.type runtime detection in network-adapter
Instead of three separate bundler aliases (Vite, esbuild main, esbuild inso),
network-adapter.ts now selects the correct adapter at runtime using
process.type === 'renderer'.
- Vite prod: process.type is already inlined as 'renderer' via define, so
Rollup tree-shakes the node branch
- esbuild main: define process.type='browser' so esbuild tree-shakes renderer branch
- esbuild inso: define process.type=undefined so esbuild tree-shakes renderer branch
- Vitest (insomnia): existing renderer alias kept for test environment
- Vitest (inso): add renderer alias to match pre-existing test behaviour and
avoid loading native node-libcurl module in tests
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: restore vite alias for network-adapter to fix server bundle build
The react-router build produces both client and server bundles. Without
the alias, the server bundle encountered a runtime require() for
'./network-adapter.renderer' that couldn't resolve (Vite inlines
process.type='renderer' via define for the server build too, so Rollup
tree-shakes to the renderer branch, but the module gets externalized in
the server bundle rather than inlined, leaving a broken runtime require).
Restoring the alias ensures both builds inline network-adapter.renderer
directly, which is safe because the module only defines functions —
window.main is never called at module init time.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feedback
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Git server for smoke test
* Try to solve flaky test
* feat: remove unused Git hook samples and add Credentials tab functionality
- Deleted various sample Git hook scripts from the git-server fixture, including post-update, pre-applypatch, pre-commit, pre-merge-commit, pre-push, pre-rebase, pre-receive, prepare-commit-msg, push-to-checkout, sendemail-validate, and update hooks.
- Introduced a new PreferencesCredentialsTab class to manage Git credentials within the Insomnia Preferences.
- Updated the PreferencesPage to include the new Credentials tab for Git credentials management.
- Enhanced the ProjectPage with a method to create a Git Sync project, including branch creation and switching.
- Added comprehensive tests for Git Sync functionality, including creating branches, committing changes, and merging branches.
- Updated UI components to support new features, including data-testid attributes for better testability.
Co-authored-by: Copilot <copilot@github.com>
* feat: update path import and add Git sync tests
* revert package.json
* Update package.json
* feat: add new dependencies for Git HTTP mock server and related utilities
* refactor: remove commented-out code in addAccessTokenGitCredential function
* fix: update export tests to use toHaveLength for file count assertions
---------
Co-authored-by: Copilot <copilot@github.com>
* Use json-bigint for parsing JSON in the response template tag [#8988]
Large numbers can lose precision when parsed using JSON.parse.
* Add unit tests to verify behavior of response template tag when handling large numbers [#8988]
* Add additional tests to cover floating point numbers
* Add inline documentation explaining usage of json-bigint + storeAsString
* Remove bespoke type definition for json-bigint; install existing one
* Add support for configuring custom OpenAI-compatible LLM endpoints via URL.
* Includes new URL backend component, backend service updates, unit tests, and
* UI consistency improvements across all LLM configuration components.
xdm