Skip to content

@apostrophecms/security-headers module setup. #225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vasilyyaremchuk merged 1 commit into from
Sep 9, 2025
Merged

@apostrophecms/security-headers module setup. #225

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions website/app.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ function createAposConfig() {
// Session configuration
modules: {
// Core modules configuration
'@apostrophecms/security-headers': {},
'@apostrophecms/express': {
options: {
session: {
Expand Down
15 changes: 6 additions & 9 deletions website/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions website/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
"dependencies": {
"@apostrophecms/form": "^1.4.2",
"@apostrophecms/import-export": "^3.2.0",
"@apostrophecms/security-headers": "^1.0.2",
"@barba/core": "^2.10.3",
Comment on lines +43 to 44

@coderabbitai coderabbitai Bot Sep 9, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Add looks good; verify version and security posture.

Before merge, confirm @apostrophecms/security-headers@^1.0.2 is the latest compatible release with your Apostrophe/Node stack and check for advisories. Also ensure the lockfile is updated in this PR to avoid drift in CI.

Run:

🏁 Script executed:

#!/bin/bash
# Check latest, peer deps, and advisories
npm view @apostrophecms/security-headers version engines peerDependencies
npm info apostrophe version
node -v
npm audit --omit=dev

Length of output: 369

🏁 Script executed:

#!/bin/bash
set -e

echo "PeerDependencies of @apostrophecms/security-headers@1.0.2:"
npm view @apostrophecms/security-headers@1.0.2 peerDependencies

echo ""
echo "Lockfiles found in repo:"
find . -type f \( -name 'package-lock.json' -o -name 'yarn.lock' \)

echo ""
echo "Detecting lockfile changes relative to base branch:"
BASE=$(git merge-base HEAD main 2>/dev/null || git merge-base HEAD origin/main 2>/dev/null || echo HEAD)
echo "Base commit: $BASE"
git diff --name-only $BASE...HEAD | grep -E 'package-lock.json|yarn.lock' || echo "No lockfile changes detected"

Length of output: 277

🏁 Script executed:

#!/bin/bash
set -e

echo "Checking security advisories in website directory:"
cd website
npm audit --omit=dev || true

echo ""
echo "Engines field for @apostrophecms/security-headers@1.0.2:"
npm view @apostrophecms/security-headers@1.0.2 engines

Length of output: 1619

security-headers upgrade and lockfile verified
@apostrophecms/security-headers@1.0.2 is the latest published version, exposes no peerDependencies or engine constraints (Node v24.3.0 is compatible) and your PR includes the updated website/package-lock.json.
npm audit --omit=dev reports 8 vulnerabilities (1 critical in form-data, 5 high in connect-multiparty, linkifyjs, on-headers, plus 2 low); run npm audit fix or otherwise resolve these before merging.

🤖 Prompt for AI Agents 
In website/package.json around lines 43 to 44, npm audit (prod) reports 8
vulnerabilities after upgrading @apostrophecms/security-headers; run npm audit
--omit=dev to confirm, then run npm audit fix --omit=dev to auto-resolve what
can be fixed, manually update or replace any remaining vulnerable transitive
packages (notably form-data and connect-multiparty) by bumping direct dependency
versions or switching to maintained alternatives, regenerate and commit
website/package-lock.json, re-run the app’s test/build to verify no regressions,
and include the updated lockfile in the PR before merging.

"abort-controller": "^3.0.0",
"apostrophe": "^4.17.0",
Expand Down
Loading