* fix: bump @xmldom/xmldom to ^0.9.12 (CVE-2026-41675)
0.9.10 has a known parser vulnerability; 0.9.12 is the latest patched release.
* fix: bump dompurify to ^3.4.14
3.4.13 has a known sanitizer bypass; 3.4.14 is the patched release.
* fix: bump ajv to ^8.20.0
8.18.0 has a known prototype-pollution issue in schema compilation; 8.20.0 is the patched release.
* fix: bump es-toolkit to ^1.51.0
1.45.1 has a known ReDoS in one of its string utilities; 1.51.0 is the patched release.
* fix: bump @apidevtools/swagger-parser to 12.1.0
Pulls in json-schema-ref-parser 14.0.1, resolving a known vulnerability in the
$ref-resolution path used when validating imported OpenAPI/Swagger documents.
Only SwaggerParser.validate() is used at the two call sites and its signature
is unchanged across this range.
* fix: bump @sentry/electron to ^7.17.0
Pulls in @sentry/node 10.70.0, resolving vulnerabilities in its bundled
@opentelemetry/core and cjs-module-lexer instrumentation dependencies.
Sentry.init options, captureException, browserTracingIntegration, and
getCurrentScope().setUser() are all used unchanged across this range.
* fix: bump zod to ^4.4.0
3.25.76 has a known validation-bypass fixed only in the v4 line. The app's
own schema code already imports from the zod/v4 subpath, so no source
changes are needed for the bump itself.
* fix: bump @rjsf/core, @rjsf/utils, @rjsf/validator-ajv8 to 6.8.0
Moves off the 6.0.0 beta onto the stable release line, which pulls in
markdown-to-jsx 9.x and resolves a known vulnerability in the pinned 7.x
line. The withTheme/FormProps/RJSFSchema/UiSchema/validateForm API surface
used by this app's JSON-schema forms is unchanged across this range.
* fix: refresh jose lockfile entry to 6.2.10
6.2.2 has a known vulnerability; 6.2.10 is already within the existing
allowed range (^6.1.3) declared by @modelcontextprotocol/sdk, so no
manifest change is needed, just an up-to-date resolution.
* fix: adapt rjsf theme templates to @rjsf/utils 6.8.0 prop changes
WrapIfAdditionalTemplate's onKeyChange/onDropPropertyClick became
onKeyRenameBlur/onRemoveProperty, ObjectFieldTemplate's idSchema/onAddClick
became fieldPathId/onAddProperty, and ArrayFieldTemplate no longer receives
raw item pieces - items are now pre-rendered elements, so the per-item
border/delete-button layout moved into a new ArrayFieldItemTemplate.
* Revert "fix: bump zod to ^4.4.0"
This reverts commit 54f1d5aa4c81ff64bf4cb9f9d478440b7311e2cd.
The v3 to v4 bump breaks real-world collection validation: import-v5-parser's
discriminated/recursive union schemas reject valid v5 collection files under
the released zod@4.4.0 (unlike the bundled zod/v4 preview subpath used
during development), failing import, export, and CLI collection-run
end-to-end tests. Deferring this upgrade separately rather than shipping a
functional regression.
* chore: regenerate lockfile after rebase onto develop
* fix: bump undici to ^7.29.1
* fix: bump @xmldom/xmldom 0.8.x to 0.8.15
* fix: bump proxy-addr to 2.0.8
* fix: bump compression to 1.8.2
* fix: bump source-map-js to 1.2.2
* fix: bump http-cache-semantics to 4.3.0
* fix: bump fast-uri to 3.1.8
* fix: bump proxy-addr, compression, source-map-js, http-cache-semantics, fast-uri in component-docs lockfile
* fix(deps): bump fast-uri to patch host-confusion SSRF vulnerabilities
fast-uri <3.1.5 is vulnerable to host confusion via backslash authority
delimiters and failed IDN canonicalization (GHSA advisories), which can
enable SSRF. ajv and @rjsf/utils already permit fast-uri ^3.x, so this
only required refreshing the lockfile resolution, no parent bump needed.
* fix(deps): bump undici to patch cookie/cache/desync vulnerabilities
undici <7.29.0 is affected by several advisories: Set-Cookie SameSite
downgrade via permissive substring matching, cross-user cache leakage
via whitespace bypass, downstream response desync via retry
interceptor, CRLF injection via blob-like body 'type', and cookie
attribute injection via unsanitized domain fields. The direct
dependency's existing ^7.25.0 range already permitted the fix, so this
only required refreshing the lockfile resolution.
Note: @connectrpc/connect-node@1.7.0 still bundles its own pinned
undici@^5.28.4 (resolves to 5.29.0), which remains vulnerable to the
older <6.24.0 advisories. Fixing that requires a major bump of
connect-node to 2.x, which needs its own review for breaking API
changes - tracked as a follow-up.
* fix(deps): bump builder-util-runtime to patch credential-leak vulnerability
builder-util-runtime <9.7.0 leaks PRIVATE-TOKEN and mixed-case
Authorization credentials on cross-origin redirects during
electron-updater's auto-update flow. electron-builder and
electron-builder-squirrel-windows pinned it exactly at 9.5.1, so
those parents needed bumping (26.8.1 -> 26.15.7) to pull the fix.
electron-updater's existing ^6.6.2 range already permitted 6.8.9,
which resolves the same fixed builder-util-runtime.
* fix(deps): bump liquidjs to patch memoryLimit bypass
liquidjs <=10.27.0's pop filter bypasses the memoryLimit accounting
enforced by its array-filter siblings, allowing a DoS via unbounded
memory growth in template rendering. Both consumers already declare
^10.27.0, which permits the fix, so this only required a lockfile
refresh (resolved to 10.28.0).
* fix(deps): bump ip-address to patch octal/decimal parsing SSRF
ip-address <=10.3.0 decodes Address4 leading-zero octets as decimal
while WHATWG URL host parsing, inet_aton, and getaddrinfo decode them
as octal, letting an attacker bypass IP-based trust boundaries and
achieve SSRF. express-rate-limit@8.3.2 pinned ip-address at an exact
10.1.0, so it needed bumping to 8.6.2 (still within @modelcontextprotocol/sdk's
^8.2.1 range) which declares ip-address ^10.2.0 and resolves to 10.4.0.
* fix(deps): bump tar to patch PAX parsing and recursion DoS issues
tar <=7.5.20 has multiple issues: process crash via PAX numeric path
type confusion, decompression/parse DoS via unlimited input, infinite
loop on negative entry size during archive replace, uncaught exception
via NUL bytes in PAX path/linkpath records, and uncontrolled recursion
in mapHas/filesFilter enabling stack-overflow DoS via crafted long-path
entries. node-gyp and @mapbox/node-pre-gyp already declare tar ^7.5.4 /
^7.4.0, which permit the fix, so this only required a lockfile refresh
(resolved to 7.5.22).
* fix(deps): bump ws to patch tiny-fragment memory exhaustion DoS
ws 8.0.0-8.20.1 bounds retained WebSocket message fragments via
maxFragments/maxBufferedChunks, but the defaults were set too high,
letting an attacker exhaust memory with many tiny fragments/chunks.
The direct ws dependency's ^8.18.1 range already permitted the fix;
socket.io/socket.io-client's bundled engine.io, engine.io-client, and
socket.io-adapter pinned ws with a `~8.20.1` tilde range that excluded
it, so those three needed bumping to pull in `~8.21.0` (still within
socket.io@4.8.3's own ~6.6.0/~6.6.1 ranges). All ws instances now
resolve to 8.21.2.
* fix(deps): bump hono to patch 33 advisories (cookie/CORS/routing/XSS)
hono <=4.12.33 accumulates a long list of fixes: cookie name validation
bypass on write/read paths, path traversal in toSSG() and serve-static
(including Windows backslash encoding), IP restriction bypass for
IPv4-mapped/non-canonical IPv6, JWT NumericDate/Bearer-scheme
validation gaps, cache middleware Vary header leakage, CORS wildcard
credential reflection, JSX SSR XSS via cx(), and a ReDoS in CORS's
Access-Control-Request-Headers handling, among others.
@modelcontextprotocol/sdk's existing ^1.17.5 range already permits
the fix; bumping it to 1.30.0 resolves hono to 4.13.0.
* fix(deps): bump valibot to patch flatten() TypeError on inherited keys
valibot <=1.4.1's flatten() helper throws a TypeError when validation
issues contain attacker-controlled object keys such as toString,
valueOf, or hasOwnProperty. @react-router/dev's existing ^1.2.0 range
already permits the fix, so this only required a lockfile refresh.
* fix(deps): bump dompurify to 3.4.13 (direct dep, lockfile refresh)
Direct dependency's existing ^3.4.10 range already permitted the fix;
this only required a lockfile refresh.
* fix(deps): bump morgan to 1.11.0 (transitive via @react-router/serve)
@react-router/serve@7.15.0's existing ^1.10.1 range already permitted
the fix, so this only required a lockfile refresh. Brings on-finished
along from ~2.3.0 to ~2.4.1 as a nested dependency bump.
* fix(deps): bump uuid from v9 to v11 to patch buffer bounds check
uuid <11.1.1 is missing a buffer bounds check in v3/v5/v6 when a buf
is provided, which can lead to memory corruption. insomnia-data,
insomnia-scripting-environment, and insomnia-smoke-test were still on
^9.0.1 (packages/insomnia already used ^11.1.1). This is a major
version bump, but the only APIs in use across these packages are v4()
and validate(), whose signatures are unchanged between v9 and v11, so
no code changes were needed. All three now resolve to uuid@11.1.1.
* fix(deps): bump csv-parse from v6 to v7
csv-parse 6.x is flagged for update to 7.0.2. This is a major version
bump (ESM/CJS dual-package modernization), but the sync `parse()` API
that packages/insomnia-scripting-environment and the sandbox's
require-interceptor (exposing it to user scripts as
'csv-parse/lib/sync') both rely on is unchanged - verified with an
identical before/after parse() smoke test. No code changes needed.
* fix(deps): bump react-router family to 7.18.2 to patch CSRF/XSS/DoS advisories
react-router 6.0.0-7.18.0 accumulates several advisories: CSRF via
PUT/PATCH/DELETE document requests, open redirect via backslash in
<Link>/useNavigate, RSCErrorHandler missing protocol validation (XSS),
arbitrary constructor injection via deserializeErrors() in SSR
hydration, and unauthenticated DoS via inefficient route matching.
react-router, @react-router/dev, @react-router/fs-routes,
@react-router/node, and @react-router/serve were all exact-pinned at
7.15.0 and needed bumping together (they're a version-locked family)
to 7.18.2 - a non-major fix version per npm audit.
One additional react-router advisory (RSC Mode CSRF Bypass, fixed only
in 8.3.0+) doesn't apply here: this app doesn't use React Server
Components (no react-server-dom-webpack/@vitejs/plugin-rsc usage in
the codebase), so the RSC-specific code path is never exercised.
As a side effect, @react-router/serve's bundled express moved from
4.22.1 to 4.22.2, which also fixes a body-parser DoS advisory
(silently-disabled size limit on invalid `limit` values) for that one
instance. Two other body-parser instances (smoke-test's own express,
and the MCP SDK's bundled express) remain on vulnerable body-parser
versions - tracked as a follow-up.
* fix(deps): bump socket.io-parser to patch zero-attachment memory exhaustion
socket.io-parser 4.0.0-4.2.6 lets a specially crafted packet make the
server wait for a large number of binary attachments and buffer them,
exhausting memory. socket.io@4.8.3's existing ~4.2.4 range already
permitted the fix, so this only required a lockfile refresh.
* fix(deps): bump body-parser (via smoke-test's express) to patch limit-bypass DoS
body-parser <1.20.6 silently disables its size-limit enforcement when
given an invalid `limit` value, allowing a DoS via unbounded request
bodies. insomnia-smoke-test's express (^4.21.2) already permitted the
fix; bumping it to 4.22.2 resolves body-parser to 1.20.6.
Note: @modelcontextprotocol/sdk still bundles express@5.2.1 with a
vulnerable body-parser@2.2.2 (needs >=2.3.0). Left unfixed for now -
Insomnia only uses the SDK's client-side StreamableHTTPClientTransport
(packages/insomnia/src/main/mcp/transport-streamable-http.ts), never
the SDK's server/express code path, so this instance is unreachable
in practice. A prior attempt to patch it via manual lockfile surgery
left package-lock.json in an inconsistent state (a resolved package
missing its "packages" entry, so `npm ci` wouldn't reproduce it) and
was reverted. Tracked as a follow-up to fix through a supported
mechanism (e.g. once @modelcontextprotocol/sdk relaxes its body-parser
range, or via a clean full lockfile regeneration reviewed on its own).
* fix(deps): bump form-data to patch CRLF injection (2 of 3 instances)
form-data <2.5.6 and >=4.0.0 <4.0.6 are vulnerable to CRLF injection
via unescaped multipart field names/filenames. @types/request's
^2.5.5 and jsdom's ^4.0.0 ranges already permitted the fix, resolving
to 2.5.6 and 4.0.6 respectively via lockfile refresh.
Note: httpsnippet@3.0.10 (the latest available release) exactly pins
form-data at 4.0.4, which stays vulnerable. There's no newer
httpsnippet version to bump to yet - this is upstream-blocked, not
fixable without an override. Tracked as a follow-up to revisit once
httpsnippet ships a fix.
* fix(deps): bump @customerio/cdp-analytics-browser to patch nested js-cookie + uuid
Bumps the pinned ^0.3.9 to ^0.5.9. This single bump fixes two
findings that were previously nested inside this analytics SDK and
not independently reachable:
- js-cookie: was exactly pinned at 3.0.1 (<=3.0.5 is vulnerable to a
per-instance prototype hijack in assign() enabling cookie-attribute
injection); now ^3.0.7, resolving to 3.0.8.
- uuid: customerio-gist-web bundled uuid@^8.3.2 (missing buffer bounds
check in v3/v5/v6, <11.1.1); now declares ^14.0.0, resolving to
14.0.1. This was the residual instance noted as a follow-up in the
earlier uuid v9->v11 commit.
The AnalyticsBrowser API surface used in use-cio.tsx (load/track/
identify/page/reset) is unchanged between 0.3.19 and 0.5.9.
* fix(deps): bump body-parser to 2.3.0 for the MCP SDK's bundled express
Fixes the remaining body-parser instance (via @modelcontextprotocol/sdk's
express@5.2.1, which declares ^2.2.1 - already permitted the fix).
This is the instance noted as unreachable/deferred in the prior
body-parser commit; the dependency graph has since shifted (from the
react-router and customerio bumps) enough that a plain `npm update
body-parser` now resolves it cleanly via a proper lockfile entry,
unlike the earlier attempt that left a broken lockfile via manual
surgery. All three body-parser instances are now fixed.
* Add vault-crypto/mime utilities and remove heavyweight third-party imports
- Add AES-GCM vault-crypto utility with tests (replaces node-forge usage)
- Add common/mime.ts to replace mime-types package dependency
- Replace tough-cookie import in response-cookies-viewer with inline parser
- Replace @grpc/grpc-js status import in grpc-status-tag with inline constant
- Replace electron.ipcRenderer in auth.clear-vault-key with showToast()
- Remove unused analytics call from window-utils
* Fix impure Date.now() key on CodeEditor; use setValue via ref instead
Replace key={Date.now()} with a useEffect that calls editorRef.current.setValue(snippet)
whenever snippet changes, keeping the editor mounted. Also apply prettier fixes from quick-check.
* fix: address Copilot review comments on PR #9992
- vault-crypto: replace forge-in-renderer with IPC bridge (main process
retains forge; renderer calls window.main.vault.{en,de}cryptSecretValue)
- mime.ts: expand lookup table to 48 entries (webp, wasm, mp4, docx, xlsx,
fonts, audio/video, etc.) and fix remaining mime-types import in send route
- response-viewer: move charset alias map to module level; normalise iconv-lite
alias names (utf8, latin1, win1252, …) to WHATWG labels for TextDecoder
- auth.clear-vault-key: fix typo "all you local" → "all your local"
* fix: sort imports in send route
* feat: disable nodeIntegration in renderer mainWindow, remove import check tooling
- Set nodeIntegration:false and contextIsolation:true on mainWindow webPreferences
(hidden window keeps nodeIntegration:true for user script execution)
- Split script-security-rules.ts out of script-security-policy.ts so the renderer
can import display-only constants without pulling in require-interceptor
- Add templating/renderer-safe.ts with Node-free render/reload/getTagDefinitions;
update all renderer callers to import from it instead of templating/index
- Split insomnia-testing generate.ts: move generateToFile to generate-to-file.ts
so generate() has no Node imports; expose generateToFile from new entry point
- Move runTests execution to main process via IPC (run-tests channel) so the
renderer routes no longer import the Mocha-backed test runner directly
- Delete vite-plugin-electron-node-require.ts, check-renderer-node-imports.ts,
renderer-node-import-baseline.json and all related scripts/plugins now that the
renderer bundle is free of Node built-in imports
* fix: sort imports, use static TestResults type, remove unused analytics import
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* remove mime stuff
* remove ci step
* update plan
* insomnia testing adapter
* use export method
* trick react router ssr
* add renderer errors
* globalThis
* improve error
* move plugin types
* ipc validate proto
* fix import
* plugin types
* polyfill events for jshint
* restore node require plugin
* vault adapter
* add crypto bridges
* tough-cookie ipc
* util stub
* split cookie into network adapter
* assert
* fix plugin index import
* serialise cookie
* decouple renderer from scripting
* Fix rebase conflicts and import path issues
- Fix incorrect ~/insomnia-data imports (should be insomnia-data package)
- Remove non-existent mime utility imports and provide simple fallback
- Remove incorrect analytics call from main process
- Remove unused imports (Settings, Cookie)
- Fix Response type annotation for getResponseBodyBuffer
* lint
* fix tests
* fix: use dynamic import for crypt in session.ts for main process compatibility
The session.ts module is used in both renderer and main process contexts (via sync.invoke IPC handlers). When running in the main process, window.main is undefined, causing TypeError when trying to access window.main.crypt.decryptAES().
Changes:
- Use dynamic import of crypt module (only loaded in main process context)
- In renderer: window.main.crypt is always available so dynamic import never executes
- In main process: dynamic import loads crypt with node:crypto support
- Protect loginStateChange() calls with window existence checks
This avoids bundling node:crypto in the Vite renderer build while still supporting both execution contexts.
Fixes E2E test failures in sync operations (remoteBackendProjects, _assertSession, etc.) caused by disabled nodeIntegration.
* fix: add aria-label to template tag preview and browser-safe encoding fallback
- Add aria-label="Live Preview" to textarea in TagEditor for better Playwright accessibility
- Add atob() fallback for decodeEncoding in browser contexts where Buffer isn't available
- Fixes smoke test element discovery for template tag preview modal
* fix: add explicit waits for element stability in environment test
Add toBeEnabled() and toBeVisible() waits before clicking elements in the
'kv pair environment can be updated' test. This prevents timeout errors from
unstable/flickering elements during modal interactions, especially in
high-concurrency shard execution.
* remove unused
* add autocomplete generate test step
* fix lint
* put analytics back in
* combine vault and crypto adapter
* remove unused export split
* remove insomnia-testing cruft, addressing feedback
* fix: use direct imports in insomnia-inso after insomnia-testing index.ts removal
* fix circular reference
* fix: move createElectronNotifier to main process to fix SSR error
Move the electron-dependent createElectronNotifier function from repo-file-watcher.ts
to git-service.ts to prevent electron imports from being evaluated in the renderer/SSR context.
* export har ipc bridge
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(nunjucks): Swapped templating engine from Nunjucks to liquidJS
* fix: resolved circular references and linting issue
* fix: updated baseline with new naming schema, no new imports introduced.
* fix: patch for playwright test (6/6)
* fix(smoke): handle multi-collection import in importFixture without timing out
* fix(smoke): ensure correct env selected before table edit
kwburns-kong