Sync upstream v2.18.0 — SSRF fix, node 24 image, and the NODE_ENV patch re-placed by hand - #22
Merged
Merged
Conversation
Third upstream sync, v2.17.0 -> v2.18.0 (134 files). Motivation is a security fix we do not have: #3166 blocks SSRF via IPv4-mapped IPv6 webhook URLs. Also picks up #3323 (libpdf upgrade), #3309 (default unset signing transport to local, which is what this instance runs) and #3351 (react router middleware). One Prisma migration, additive and nullable: 20260818081941_add_api_token_last_used_property adds ApiToken.lastUsedAt. docker/Dockerfile was hand-merged rather than patched. Upstream #3332 moved the image to node 24 / alpine 3.23, rewrote `ENV K V` into `ENV K=V`, pinned turbo from the lockfile, switched the runner stage to `npm ci --omit=dev` and strips esbuild residue. Our fork-local `ENV NODE_ENV="production"` anchors on the two lines that rewrite touched, so re-applying the patch would have conflicted; the block was placed by hand in the runner stage instead. Without it the instance serves React Router's development bundle and useSecureCookies stays false, which is the dev-mode cookie bug fixed in #6. Imported with `git read-tree -u --reset` per DEVALOK_FORK_NOTES.md, so upstream deletions carry across: apps/remix/Dockerfile.bun and apps/remix/Dockerfile.pnpm are removed. Workflow guards re-applied to 13 files / 14 jobs; upstream added and deleted no workflows this cycle. A per-job audit leaves only the two intentionally open jobs, ci.yml/build_docker and codeql-analysis.yml/analyze. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third upstream sync: v2.17.0 → v2.18.0, 134 files.
Why now
Upstream carries a security fix this instance does not have:
local(this instance runslocal)Migration
One, additive and nullable —
20260818081941_add_api_token_last_used_propertyaddsApiToken.lastUsedAt. No drops, no truncates.The one thing that needed judgement
docker/Dockerfilewas hand-merged, not patched. Upstream #3332 moved the image to node 24 / alpine 3.23, rewroteENV K VintoENV K=V, pinned turbo from the lockfile, switched the runner tonpm ci --omit=devand strips esbuild residue.Our fork-local
ENV NODE_ENV="production"anchors onENV HUSKY 0/ENV DOCKER_OUTPUT 1— the exact two lines that rewrite touched — so a patch apply would have conflicted or, worse, landed in the wrong stage. It was placed by hand in the runner stage.That block is load-bearing: without it the instance serves React Router's development bundle and
useSecureCookiesstays false, so session cookies ship withoutSecureand without the__Secure-prefix. That is the bug fixed in #6 and it would have silently returned. Upstream's newnpm ci --omit=devnow makes it belt-and-braces rather than the only guard.After the merge,
docker/Dockerfilediffers from upstream v2.18.0 by that block and nothing else.Fork hygiene
Imported with
git read-tree -u --resetperDEVALOK_FORK_NOTES.md, so upstream deletions carry across —apps/remix/Dockerfile.bunandapps/remix/Dockerfile.pnpmare removed. (Missing deletions is exactly how the June 2026 sync left dead code in prod for 2.5 months.)Guards re-applied to 13 workflow files / 14 jobs. Upstream added and deleted no workflows this cycle. The per-job audit leaves only the two intentionally open jobs:
ci.yml/build_dockerandcodeql-analysis.yml/analyze.The staged tree differs from upstream v2.18.0 in exactly 15 files — the 13 guarded workflows,
DEVALOK_FORK_NOTES.md, anddocker/Dockerfile.Before merging
build_dockerto go green. Railway's trigger onmainhascheckSuites: false, so the merge deploys immediately without waiting for CI.db-backups/documenso/2026-09-19/documenso.dump.gpgon R2 (3.1 MB,pg_dump -Fc -Z9, database is 30 MB). Ciphertext round-trip verified; the decrypt half could not be verified on the laptop becausegpg-agentwill not start there.mainrequires an approving review and I cannot self-approve, so this needs:gh pr merge <n> --repo devalok-design/documenso --squash --admin --delete-branchNot in this PR
Document storage still points at the AWS account lost on 2026-09-11 (
NEXT_PRIVATE_UPLOAD_BUCKET=documenso-devalok,ap-south-1). An R2 bucketdocumenso-storagehas been created to receive it; the cutover needs an R2 S3 token and is separate from this version bump.🤖 Generated with Claude Code