Skip to content

React security vulnerability updates #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sbddesign merged 5 commits into from
Apr 8, 2026
Merged

React security vulnerability updates #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ac0b7b9
Refactor: Update dependencies and fix minor text issues
cursoragent Dec 12, 2025
e0f18b4
feat: Add pnpm-lock.yaml for dependency management
cursoragent Dec 12, 2025
6d06511
Delete pnpm-lock.yaml
sbddesign Dec 12, 2025
3801a94
update next to 14.2.35
sbddesign Dec 14, 2025
fbe3978
Merge main into PR branch, resolve conflicts, and pin React to patche…
sbddesign Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .env.test
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,5 @@ NETWORK="regtest"
DOMAINS={"12cash.dev": "id123"}
PROVIDER="cloudflare"
CF_TOKEN=""
JWT_SECRET="abc123"
JWT_SECRET="abc123"
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Avoid weak JWT secret defaults, even in test config.

Line 5 uses abc123, which is trivially guessable. Prefer a long random value to reduce accidental cross-environment risk.

🧰 Tools
🪛 dotenv-linter (4.0.0)

[warning] 5-5: [QuoteCharacter] The value has quote characters (', ")

(QuoteCharacter)

[warning] 5-5: [UnorderedKey] The JWT_SECRET key should go before the NETWORK key

(UnorderedKey)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.env.test at line 5, Replace the trivial JWT_SECRET value used for tests
with a strong random string: update the JWT_SECRET entry to a long, high-entropy
value (e.g., 32+ characters of mixed upper/lowercase, digits, and symbols) or
load it from a secure test-only secret generator; ensure the JWT_SECRET key name
remains unchanged so code referencing JWT_SECRET continues to work and update
any test setup scripts that may seed a default to use the stronger value.

DATABASE_URL="postgresql://postgres:password@localhost:5432/twelvecash_test"
4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,9 +32,9 @@
"next": "^15.1.0",
"nostr-tools": "^2.7.1",
"qrcode.react": "^3.1.0",
"react": "^19",
"react": "^19.0.1",
"react-confetti": "^6.1.0",
"react-dom": "^19",
"react-dom": "^19.0.1",
"react-hook-form": "^7.52.1",
"react-use": "^17.5.0",
"superjson": "^2.2.1",
Expand Down
4 changes: 2 additions & 2 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.