Skip to content

[Snyk] Upgrade svix from 1.89.0 to 1.94.0 - #58

Merged
ericviana merged 3 commits into
mainfrom
snyk-upgrade-ec1a1f5fb6990f311d1a35b8e8385ad4
Jul 27, 2026
Merged

[Snyk] Upgrade svix from 1.89.0 to 1.94.0#58
ericviana merged 3 commits into
mainfrom
snyk-upgrade-ec1a1f5fb6990f311d1a35b8e8385ad4

Conversation

@BernardoSM

Copy link
Copy Markdown
Contributor

snyk-top-banner

Snyk has created this PR to upgrade svix from 1.89.0 to 1.94.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


  • The recommended version is 6 versions ahead of your current version.

  • The recommended version was released a month ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Improper Validation of Specified Index, Position, or Offset in Input
SNYK-JS-UUID-16133035
636 Proof of Concept
Release notes
Package name: svix
  • 1.94.0 - 2026-05-19

    What's Changed

    • Libs (New): Webhooks AutoConfig SDK
    • Libs/Java: Restore compatibility with Java 1.8 in Webhooks verification

    Full Changelog: v1.93.0...v1.94.0

  • 1.93.0 - 2026-05-07

    What's Changed

    • Server: Warn when Redis pending timeout is shorter than worker request timeout + buffer (thanks @ vinay0826)
    • Server: Add missing messageattempt index (as a new kind of background migration)
    • CLI: Show input / output JSON examples in --help output
    • Libs/Java: Restore compatibility with Java 1.8

    Full Changelog: v1.92.2...v1.93.0

  • 1.92.2 - 2026-04-23

    What's Changed

    • Libs/JavaScript: Remove dependency on uuid (thanks @ ulrichstark)

    Full Changelog: v1.91.1...v1.92.2

  • 1.91.1 - 2026-04-21

    Changes

    • Fix docker build

    What's Changed

    Full Changelog: v1.91.0...v1.91.1

  • 1.91.0 - 2026-04-20

    What's Changed

    • Server: Remove old endpoint secrets on rotation
    • Libs/Ruby: various fixes to the ruby sdk

    Full Changelog: v1.90.0...v1.91.0

  • 1.90.0 - 2026-04-02

    What's Changed

    • Server: Add throttleRate to endpoint and application
      • This replaces rateLimit because the name caused some confusion
        (but is kept as a deprecated field for backwards compatibility)
    • Libs/All: Update to latest Svix Cloud spec

    Full Changelog: v1.89.0...v1.90.0

  • 1.89.0 - 2026-03-19

    What's Changed

    • Server: Add a prune helper command to delete old data
    • Server: Invalidate CMA cache when creating/updating endpoints or apps
    • Server: Return empty JSON object from v1.message-attempt.resend
    • Server: Build Docker image with Rust 1.94
    • Bridge: Add support for PLAIN sasl auth for confluent cloud
    • Bridge: Build Docker image with Rust 1.94
    • Libs/Python: Set __str__ on errors

    Full Changelog: v1.88.0...v1.89.0

from svix GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade svix from 1.89.0 to 1.94.0.

See this package in npm:
svix

See this project in Snyk:
https://app.snyk.io/org/bernardosm/project/fcb427ab-450a-473a-921f-25bc0a49fc59?utm_source=github&utm_medium=referral&page=upgrade-pr
@BernardoSM

BernardoSM commented Jun 15, 2026

Copy link
Copy Markdown
Contributor Author

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Snyk edits package.json only, so `bun install --frozen-lockfile` failed with
"lockfile had changes, but lockfile is frozen" and the lint job has been red since
2026-06-15. This regenerates the lockfile so CI can run.

Claude-Session: https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs
@ericviana
ericviana merged commit f10b736 into main Jul 27, 2026
9 checks passed
@ericviana
ericviana deleted the snyk-upgrade-ec1a1f5fb6990f311d1a35b8e8385ad4 branch July 27, 2026 15:08
ericviana added a commit that referenced this pull request Jul 27, 2026
…#60)

Publish runs on every push to main and unconditionally calls `npm publish`, so any
merge that does not bump the version fails the run with:

  npm error You cannot publish over the previously published versions: 4.0.2.

That just happened twice, on #52 and #58. The noise matters: a permanently red
publish job is how blindpay-cli's genuinely broken publish went unnoticed for two
and a half months and left npm three versions behind.

This adds the same version guard already merged into blindpay-cli and blindpay-mcp,
so an unchanged version is a no-op instead of a failure.

Also tags and creates a GitHub release on publish. This repo has published up to
4.0.2 on npm and has zero git tags, so there is currently no way to see what
shipped in a release from the repo alone.

Two notes, neither addressed here:
- `.changeset/` has around 20 accumulated changeset files and no workflow consumes
  them, so version bumps are effectively manual edits to package.json. Worth either
  wiring up `changeset version` or dropping changesets.
- main currently carries the #52 and #58 fixes at an unbumped 4.0.2, so they are
  unreleased. The next version bump ships them.

Claude-Session: https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants