Conversation
composer audit flagged laravel/framework v12.53.0 as affected by GHSA-5vg9-5847-vvmq / CVE-2026-48019 (patched in 12.60.0). Update to v12.61.0 (within the existing ^12.0 constraint; pulls minor bumps of guzzle, flysystem, league/uri, laravel/prompts). composer audit now reports no advisories and the full suite (353 tests) passes. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Resolve the 'Node.js 20 actions are deprecated' warnings by bumping every
JS action to its Node-24 runtime release:
- actions/checkout v4->v5, actions/setup-node v4->v5, actions/cache v4->v5
- docker/build-push-action v5->v7, docker/login-action v3->v4,
docker/setup-buildx-action v3->v4, docker/metadata-action v5->v6
- github/codeql-action/* v3->v4
Declare Node 24 in the webapp: add engines.node >=24 and .nvmrc (24), and
migrate @tsconfig/node22 -> @tsconfig/node24 (tsconfig.node.json extends).
Also fix the deploy.yml SSH debug line: ${#{{ secrets.SERVER_SSH_KEY }}}
expanded the secret inline and produced a bash 'bad substitution' error in
the failure branch; pass the secret via a step env var and use ${#SSH_KEY}.
Verified locally on node 24.16.0: install clean, @tsconfig/node24 24.0.4,
type-check and 170 webapp unit tests pass.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #1204. Three focused changes, all validated green on
dev.🔒 Security — CVE-2026-48019 (Laravel)
composer auditflaggedlaravel/frameworkv12.53.0 (GHSA-5vg9-5847-vvmq, patched in 12.60.0). Bumped to v12.61.0 (within^12.0; pulls minor guzzle/flysystem/league/prompts bumps).composer auditnow clean; 353 API tests pass.🟢 Node 24 LTS migration
Resolves the "Node.js 20 actions are deprecated" warnings (verified 0 remaining):
App now declares Node 24:
engines.node >=24,.nvmrc(24), and@tsconfig/node22 → @tsconfig/node24.🔧 Deploy SSH debug fix
deploy.yml's failure-branch debug line${#{{ secrets.SERVER_SSH_KEY }}}interpolated the secret inline and produced a bashbad substitution. Now passes the secret via a stepenv: SSH_KEYand uses${#SSH_KEY}.Validation (on
dev)Deploy run success —
build/docker-web+build/docker-api(build-push@v7), Required Checks, Code Quality, CodeQL all green. Webapp: type-check + 170 unit tests pass on Node 24.16.0.🤖 Generated with Claude Code