Repository navigation
chore: sync main into release-candidate-v0.47.0 - #173
Merged
Shivam-nagar23 merged 9 commits intoSep 18, 2026
Merged
Conversation
Support DB_SSL_MODE (disable|require|verify-ca|verify-full) and DB_SSL_ROOT_CERT for the notifier's TypeORM/pg connection. Defaults to disable (plaintext) to preserve existing behaviour. Enables connecting to SSL-enforcing Postgres such as AWS RDS with rds.force_ssl=1. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
TypeORM's ConnectionOptions.ssl is typed boolean | TlsOptions. Return TlsOptions from buildSslOptions and set checkServerIdentity via a cast (honoured by tls.connect at runtime but absent from the TlsOptions type), resolving the TS2322 build failure. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
feat: add optional SSL/TLS support for PostgreSQL connection
Bumps direct dependencies and adds/updates npm overrides so every
package flagged by Dependabot resolves at or above its patched version.
Direct dependencies:
- axios 1.13.6 -> 1.19.0 (28 alerts: proxy credential leak, SSRF,
prototype pollution, ReDoS, DoS)
- body-parser 1.20.4 -> 1.20.6 (limit bypass DoS)
- js-yaml 3.14.2 -> 3.15.1 (merge-key quadratic DoS)
- typeorm 0.3.28 -> 0.3.31 (orderBy SQL injection, migration codegen
injection)
Overrides (transitive, mostly via notifme-sdk -> node-pushnotifications
-> firebase-admin/google-cloud):
- protobufjs 7.5.3 -> 7.6.5 (12 alerts, incl. code injection)
- @protobufjs/utf8 1.1.0 -> 1.1.2
- nodemailer 7.0.13 -> 9.0.3 (raw-option file read/SSRF, CRLF
header injection, OAuth2 TLS)
- websocket-driver 0.7.4 -> 0.7.5 (critical: message corruption)
- @grpc/grpc-js 1.13.4 -> 1.14.4 (malformed-request crash)
- lodash 4.17.23 -> 4.18.1
- form-data 4.0.5 -> 4.0.6 (CRLF injection)
- fast-xml-parser 5.5.9 -> 5.10.1
- fast-xml-builder 1.1.4 -> 1.3.0 (attribute-quote bypass)
- follow-redirects 1.15.11 -> 1.16.0
- qs 6.15.0 -> 6.15.3 (stringify DoS)
- uuid 8.3.2/9.0.1 -> 11.1.1 (missing buffer bounds check)
- path-to-regexp@0.1 -> 0.1.13 (ReDoS via express 4)
- @tootallnate/once -> 2.0.1
- brace-expansion@1 -> 1.1.18, @2 -> 2.1.4 (unbounded expansion OOM)
- js-yaml@4 -> 4.3.1 (mocha, dev-only)
The node-gcm-scoped axios override is replaced by a top-level one so a
single deduped copy is installed instead of two.
Verified: npm audit reports 0 vulnerabilities, tsc build succeeds, test
suite passes, and notifme-sdk still constructs SMTP and SES transports
against nodemailer 9.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
misc: resolve all 73 open Dependabot alerts
Add event type 16 for deployment approval decline (veto by super-admin). Follows the same pattern as DeploymentCancelled (event 13): - New enum value and parsed event interface in types.ts - Parsing branch in mustacheHelper.ts - Slack/SES/SMTP Mustache templates (16.mustache) - Excluded from CI/CD material parsing guard Uses standard notification routing (not the approval-specific path), matching the convention for cancelled events (13-15). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…path sendNotificationV2 only read event.payload.providers for the approval/ approved event types, so declined events (16) fell through to the settings path, found no settings, and were dropped. Add DeploymentDeclined to that list so it uses the providers the orchestrator attaches (eligible approvers + requester) and renders the event-16 templates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…clined-notification feat: add Decline (veto) notification — DeploymentDeclined event type 16
vivek-devtron
approved these changes
Sep 18, 2026
mayank-devtron
approved these changes
Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the latest
mainintorelease-candidate-v0.47.0.Merged clean (no conflicts). Commits brought in from
main:feat/deployment-approval-declined-notificationdependabot-safe-patchesfeat-postgres-sslFiles touched:
package.json,package-lock.json,src/common/mustacheHelper.ts,src/common/types.ts,src/config/database.ts,src/notification/service/notificationService.ts, and new16.mustachetemplates for ses/slack/smtp.🤖 Generated with Claude Code