chore(deps): bump twilio from 5.13.1 to 6.0.2#14
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [twilio](https://github.com/twilio/twilio-node) from 5.13.1 to 6.0.2. - [Release notes](https://github.com/twilio/twilio-node/releases) - [Changelog](https://github.com/twilio/twilio-node/blob/main/CHANGES.md) - [Upgrade guide](https://github.com/twilio/twilio-node/blob/main/UPGRADE.md) - [Commits](twilio/twilio-node@5.13.1...6.0.2) --- updated-dependencies: - dependency-name: twilio dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Merged
7 tasks
3 tasks
freegenie
added a commit
that referenced
this pull request
May 27, 2026
Resolves CodeQL alerts #14 (clear-text-logging at users/seed.ts:55) and #15 (its sink in utils/file-logger.ts:82 where the same banner is tee'd to the daily engine-YYYY-MM-DD.log file). Previously, when INITIAL_ADMIN_PASSWORD was unset on first boot, seed.ts generated a random password and printed it inside a banner via console.warn. file-logger.ts intercepts console.* and writes everything to the daily log file with 14-day retention, so the secret was effectively persisted. New behaviour: INITIAL_ADMIN_PASSWORD is now REQUIRED to seed the admin. When absent the seeder logs a single warning explaining what to do, never calls insertUser, and never emits the password. The "password provided via env" path is unchanged — the env path was already log-safe (email-only). Tests updated to lock the new contract. .env.example reflects the new requirement. Breaking change for fresh deployments: operators must set INITIAL_ADMIN_PASSWORD before the first boot or seeding is skipped. Signed-off-by: Fabrizio Regini <fabrizio@exelab.com>
paolovalletta-exelab
pushed a commit
that referenced
this pull request
May 28, 2026
…#24) Resolves CodeQL alerts #14 (clear-text-logging at users/seed.ts:55) and #15 (its sink in utils/file-logger.ts:82 where the same banner is tee'd to the daily engine-YYYY-MM-DD.log file). Previously, when INITIAL_ADMIN_PASSWORD was unset on first boot, seed.ts generated a random password and printed it inside a banner via console.warn. file-logger.ts intercepts console.* and writes everything to the daily log file with 14-day retention, so the secret was effectively persisted. New behaviour: INITIAL_ADMIN_PASSWORD is now REQUIRED to seed the admin. When absent the seeder logs a single warning explaining what to do, never calls insertUser, and never emits the password. The "password provided via env" path is unchanged — the env path was already log-safe (email-only). Tests updated to lock the new contract. .env.example reflects the new requirement. Breaking change for fresh deployments: operators must set INITIAL_ADMIN_PASSWORD before the first boot or seeding is skipped. Signed-off-by: Fabrizio Regini <fabrizio@exelab.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps twilio from 5.13.1 to 6.0.2.
Release notes
Sourced from twilio's releases.
... (truncated)
Changelog
Sourced from twilio's changelog.
... (truncated)
Upgrade guide
Sourced from twilio's upgrade guide.
... (truncated)
Commits
e9e5469Release 6.0.2fd93dfa[Librarian] Regenerated @ d39d243cf0f072a87b06d80cfd5d04f77cde8481 18d7938080...c4d7168Release 6.0.104a89ce[Librarian] Regenerated @ d39d243cf0f072a87b06d80cfd5d04f77cde8481 e2fda0239d...d6b406f[Librarian] Regenerated @ 40ca64a22aef42a337cb49d1d4e4c4f48ae3b6e4 21ed5806ef...3e96b64chore: mvr 6.0.0 release prep (#1186)447a23dRelease 5.13.26267242[Librarian] Regenerated @ 40ca64a22aef42a337cb49d1d4e4c4f48ae3b6e4 21ed5806ef...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)