Skip to content

v0.36.0

Choose a tag to compare

View all tags
@KIvanow KIvanow released this 07 Aug 12:23
· 9 commits to master since this release
v0.36.0
5cb2625
This commit was signed with the committer’s verified signature.
KIvanow Kristiyan Ivanov
GPG key ID: 4BB27D5B662BC86B
Verified
Learn about vigilant mode.

Security release: every open critical, high, and medium Dependabot alert resolved - 62 alerts closed (60 fixed, 2 dismissed with documented justification), spanning 53 distinct security advisories across 19 dependencies, verified end-to-end on both the Docker image and the npx package.

BetterDB Monitor now ships with a fully clean security scorecard: zero open critical, high, or medium vulnerability alerts. Overall - 62 alerts fixed covering 53 distinct security advisories, tested every fix individually.

This update also makes the Docker container health check report correctly and comes with a refreshed README. No breaking changes - updating is safe and recommended for all users. Full technical details below.

🔒 Security

Critical

  • seroval ≤ 1.5.2 → 1.5.6 (CVE-2026-59940) - type confusion in fromJSON() let attacker-controlled JSON invoke unintended methods during Promise-resolver deserialization - potential RCE when untrusted Seroval JSON is deserialized with plugins enabled. (#364)

High

  • form-data → 4.0.6 (CVE-2026-12143) - CRLF injection via unescaped multipart field names/filenames.
  • brace-expansion → 1.1.18 / 2.1.4 / 5.0.9 (CVE-2026-14257, CVE-2026-69152, CVE-2026-13149) - three DoS vectors: unbounded expansion (OOM), unbounded intermediate arrays (bypass of the first fix), and exponential-time {} group expansion.
  • ip-address → 10.4.0 (CVE-2026-69192) - leading-zero octets decoded as decimal while resolvers decode octal, letting SSRF filters approve internal targets.
  • fast-uri → 3.1.5 (CVE-2026-18446, CVE-2026-16221, CVE-2026-13676) - three host-confusion parses (backslash authority introducer/delimiter, failed IDN canonicalization) enabling allowlist bypass.
  • postcss → 8.5.26 (CVE-2026-45623, GHSA-r28c-9q8g-f849) - arbitrary .map file disclosure via attacker-controlled sourceMappingURL, including the incomplete-fix follow-up.
  • shell-quote → 1.10.0 (CVE-2026-13311) - quadratic-complexity DoS in parse().
  • js-yaml → 3.15.1 / 4.3.1 (CVE-2026-59869) - YAML merge-key alias chains forcing quadratic CPU consumption.
  • axios → 1.18.0 (GHSA-gcfj-64vw-6mp9) - Node HTTP adapter could route requests through an inherited (prototype-polluted) proxy after interceptor config cloning; also picks up the formToJSON/maxBodyLength/NO_PROXY hardening set.
  • adm-zip → 0.6.0 (CVE-2026-39244) - crafted ZIP header triggers a 4 GB allocation (DoS).
  • find-my-way → 9.7.0 (CVE-2026-47219) - DDoS via HTTP/2 against the fastify router.
  • @fastify/static → 10.1.2 everywhere (CVE-2026-15074, CVE-2026-7120) - route-guard bypass via path traversal; the vulnerable 9.3.0 copy pulled by @fastify/swagger-ui is deduped away.
  • sharp → 0.35.3 (GHSA-f88m-g3jw-g9cj) - inherited libvips CVE-2026-33327/33328/35590/35591, exploitable via malicious image input.
  • react-router → 7.18.2 (CVE-2026-55685, plus mediums CVE-2026-53666/53667/53669) - unauthenticated DoS via inefficient route matching, open redirect, RSC error-handler XSS, and constructor injection.

Medium

  • hono → 4.13.1 (CVE-2026-69207, CVE-2026-59895, CVE-2026-59896, CVE-2026-59897) - CORS-middleware ReDoS, JSX cx() XSS escape bypass, cross-request jsx context disclosure, and repeated-header loss in the API Gateway adapter. (#366)
  • dompurify → 3.4.13 (CVE-2026-49978, CVE-2026-49458, CVE-2026-49459, CVE-2026-65902, CVE-2026-65898) - five sanitization-bypass / allowlist-pollution flaws; also closes three low-severity dompurify alerts.
  • valibot → 1.4.2 (CVE-2026-59952) - record() issue paths could make flatten() throw on inherited Object property names (DoS on untrusted input).
  • @hono/node-server → 2.1.0 (GHSA-frvp-7c67-39w9) - path traversal in serve-static on Windows via encoded backslash; 1.x → 2.x major keeps the hono ^4 peer range.
  • @opentelemetry/core → 2.9.0 (CVE-2026-54285) - unbounded memory allocation in W3C Baggage propagation; all 1.30.1/2.2.0/2.6.1 copies deduped to a single patched resolution.

Dismissed with justification (not exploitable here)

  • react-router RSC-mode CSRF (GHSA-qwww-vcr4-c8h2) - patched only in react-router 8.3.0, which requires React ≥ 19.2.7 / Node ≥ 22.22.0 (outside the supported matrix) and has no matching react-router-dom release. The vulnerable RSC server-action path is unreachable in the client-side Vite SPA. Revisit when react-router-dom ships an 8.x line.
  • file-type ASF-parser infinite loop (CVE-2026-31808) - the vulnerable 16.5.4 exists only inside ibm-cloud-sdk-core (unused watsonx path). The patched 21.x line is ESM-only and verifiably breaks the SDK's CJS FileType.fromBuffer call. Revisit if ibm-cloud-sdk-core updates its file-type dependency.

🛠️ Internal

  • packages/agent-memory - span tests moved from @opentelemetry/sdk-trace-base 1.x to ^2.9.0 to match the core 2.x security override (the 1.x SDK imported the removed getEnv()); removes the last OpenTelemetry 1.x entries from the lockfile. (#366)

🐛 Bug fixes

  • Docker HEALTHCHECK reported unhealthy on healthy containers - the Dockerfile healthcheck probed /health, which production builds only serve as the SPA fallback for GET; wget's spider request got a non-2xx and the container sat permanently unhealthy. Both Dockerfile and Dockerfile.prod now probe the real /api/health endpoint. (#365)

📚 Docs

  • README refreshed (product-first restructure, badges, new hero screenshot); production examples now use the /api-prefixed endpoint paths that production builds actually serve; the intentional Docker tag scheme is documented - latest deliberately tracks the no-ai build, while the experimental AI Helper ships only in the versioned full image. (#365)

⬆️ Upgrade notes

  • Fully backwards compatible - all security fixes are dependency version bumps via pnpm.overrides; no API, schema, or config changes. Both distribution channels were verified end-to-end against a live Valkey 9.1.0 instance (health, metrics/INFO parsing, web UI) on this exact dependency set.
  • Worth a glance if you embed the web app: react-router moves 7.17.0 → 7.18.2 (same major) and @hono/node-server moves 1.x → 2.x inside the MCP server stack (peer range unchanged, suites pass).
  • Docker: betterdb/monitor:0.36.0

What's Changed

  • fix(deps): resolve all critical and high Dependabot security alerts in #364
  • fix(deps): resolve all medium-severity Dependabot security alerts in #366
  • docs: refresh README and fix production endpoint paths in #365

Full Changelog: v0.35.0...v0.36.0

What's Changed

  • fix(deps): resolve all critical and high Dependabot security alerts by @KIvanow in #364
  • fix(deps): resolve all medium-severity Dependabot security alerts by @KIvanow in #366
  • docs: refresh README and fix production endpoint paths by @KIvanow in #365

Full Changelog: v0.35.0...v0.36.0

Contributors

KIvanow
Assets 3
Loading