Skip to content

fix(deps): update dependency @adonisjs/core to v7 [security] - #596

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-adonisjs-core-vulnerability
Open

fix(deps): update dependency @adonisjs/core to v7 [security]#596
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-adonisjs-core-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@adonisjs/core 5.9.0 → 7.3.1 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

@​adonisjs/http-server has an Open Redirect vulnerability

CVE-2026-40255 / GHSA-6qvv-pj99-48qm

More information

Details

Impact

The response.redirect().back() method in @adonisjs/http-server is vulnerable to open redirects. The method reads the Referer header from the incoming HTTP request and redirects to that URL without validating the host. An attacker who can influence the Referer header (for example, by linking a user through an attacker-controlled page before a form submission) can cause the application to redirect users to a malicious external site.

This affects all AdonisJS applications that use response.redirect().back() or response.redirect('back').

The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect').

Patches

This has been fixed in @adonisjs/http-server version 8.2.0. The back() method now validates the Referer header's host against the request's own Host header. Referrers from unrecognized hosts are rejected and the redirect falls back to / (or a developer-provided fallback URL).

Applications that operate across multiple domains can configure additional trusted hosts via the redirect.allowedHosts option in config/app.ts.

Users should upgrade to @adonisjs/http-server@^8.2.0 (or @adonisjs/core@^7.4.0 if using the core meta-package).

Workarounds

If upgrading is not immediately possible, avoid using response.redirect().back() in routes that are reachable by unauthenticated users or from pages that accept external traffic. Instead, redirect to a known safe path explicitly using response.redirect().toPath('/dashboard').

References

Severity

  • CVSS Score: 6.1 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

adonisjs/core (@​adonisjs/core)

v7.3.1: Preventing open-redirect vulnerabilities during referer based redirects

Compare Source

Full Changelog: adonisjs/core@v7.3.0...v7.3.1

v7.3.0: Allow make commands to override existing files via --force flag

Compare Source

Features
  • add --force flag to all make commands (bb90a45)

Full Changelog: adonisjs/core@v7.2.0...v7.3.0

v7.2.0: Safe timing helpers, vine.create usage in validator stub and create building using custom tsconfig file

Compare Source

Bug Fixes
  • replace vine.compile with vine.create in validator stub (#​5082) (487246a)
  • update validator test to use vine.create (9d7c8fc)
Features

What's Changed

New Contributors

Full Changelog: adonisjs/core@v7.1.1...v7.2.0

v7.1.1: Fix indexEntities to create manifest file when manifest.enabled is true

Compare Source

Bug Fixes
  • enable manifest explicitly (038fc87)

Full Changelog: adonisjs/core@v7.1.0...v7.1.1

v7.1.0: Add JSONL route formatter for AI agents

Compare Source

Bug Fixes
  • linting and formatting issues (936b778)
Features
  • add JSONL route formatter for AI agents and improve command descriptions (b59a82b)
  • auto-select JSON output for list command when running in AI agent (f8d58a0)

Full Changelog: adonisjs/core@v7.0.1...v7.1.0

v7.0.1: Drop hardcoded @​next package tags

Compare Source

Fixes

  • Removed hardcoded @​next tags for AdonisJS packages.

Maintenances

  • Updated tests to keep CI stable.

v7.0.0: Type-safe URL builder, barrel files, tooling for e2e type-safety and much more 🚀

Compare Source

Features
  • add comments to auto-generated files (9ce40a3)
  • export http helpers (0f84231)
  • index entities allow custom path for inertia middleware (cbf4516)

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.19.0...v7.0.0

v6.21.0

Compare Source

v6.20.0: Security update

Compare Source

Security update for CVE-2026-25754 (GHSA-f5x2-vj4h-vg4c) & CVE-2026-25762 (GHSA-xx9g-fh25-4q64).

Features

v6.19.3: Update dependencies

Compare Source

6.19.3 (2026-01-10)

v6.19.2: Security update

Compare Source

Security update for CVE-2026-21440 (GHSA-gvq6-hvvp-h34h)

Full Changelog: adonisjs/core@v6.19.1...v6.19.2

v6.19.1: Add support for VineJS v4

Compare Source

Full Changelog: adonisjs/core@v6.19.0...v6.19.1

v6.19.0: Export VineMultipartClass for extending and fix multipart file serialization issue

Compare Source

Features

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.18.0...v6.19.0

v6.18.0: Use merged request body when mergeMultipartFieldsAndFiles is enabled

Compare Source

Please read the release notes of @adonisjs/bodyparser package to understand how merged request body works and why this feature was added. https://github.com/adonisjs/bodyparser/releases/tag/v10.1.0. Solves issue #​4777

Features
  • enable allowUnknownFlags for specific commands (6fdf953)
  • use merged request body during validation when mergeMultipartFieldsAndFiles flag is enabled (bd80b39), closes #​4777

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.17.2...v6.18.0

v6.17.2: Update dependencies

Compare Source

6.17.2 (2025-02-13)

  • fix: pin swc as it is broken (84c7d75)
  • chore: update dependencies (9f055da)

Full Changelog: adonisjs/core@v6.17.1...v6.17.2

v6.17.1: Update dependencies

Compare Source

6.17.1 (2025-01-12)

  • ci: add stale workflow (71db68d)
  • chore: update dependencies (df6e922)

Full Changelog: adonisjs/core@v6.17.0...v6.17.1

v6.17.0: Improvements to the list routes command

Compare Source

6.17.0 (2024-12-15)

  • test: add brisk route in list routes test (85e49e7)
  • test: fix breaking tests (cf622f0)
  • refactor: display of route handler (fbebf24)
  • feat: display route closure listArgs when listing routes (880b5b7)
  • chore: update dependencies (ddf0c5c)

Full Changelog: adonisjs/core@v6.16.0...v6.17.0

v6.16.0: Fix NODE_ENV issue with test command and Verification token abstract class

Compare Source

6.16.0 (2024-12-05)

  • fix: force NODE_ENV=test when running the test command (25a8d8a), closes #​4794
  • feat: add VerificationToken abstract class (ec313c2)
  • chore: update dependencies (befb276)

Full Changelog: adonisjs/core@v6.15.2...v6.16.0

v6.15.2: Support VineJS 3.0

Compare Source

6.15.2 (2024-12-01)

  • chore: update dependencies (74287db)

Full Changelog: adonisjs/core@v6.15.1...v6.15.2

v6.15.1: Update dependencies

Compare Source

  • chore: update dependencies (4e9464c)
  • chore: upgrade install-pkg to 0.5 (21d29b3)
  • refactor(stubs): use generators to make service class name (e7d0974)

Full Changelog: adonisjs/core@v6.15.0...v6.15.1

v6.15.0: Small improvements to commands

Compare Source

  • fix(commands): use Array#some instead of Array#includes for type-safety (c598b55)
  • ci: update node version (8696178)
  • chore: update dependencies (3104d11)
  • feat(stubs): generate an empty class when creating a service (bf9b2bd)
  • doc: update installPackages jsdoc to match current implementation (#​4766) (41f5d66), closes #​4766

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.14.1...v6.15.0

v6.14.1: Update dependencies

Compare Source

Full Changelog: adonisjs/core@v6.14.0...v6.14.1

v6.14.0: Add support for dd and dump helpers

Compare Source

The dd helper can be used like console.log but it provides a better visual experience and also comes with a HTML printer. The helper throws an exception and self handles itself to render the dumped value inside the browser (during an HTTP request) or in the console (default output).

You can use the dd helper as follows.

import { dd } from '@adonisjs/core/services/dd'
dd(someValue)

The same helper is available in Edge template as @dd tag. Also, within Edge templates you may use the @dump to inspect a value without throwing an exception.

{{-- Dump and halt rendering --}}
@dd(someValue)

{{-- Dump and continue rendering --}}
@dump(someValue)

Bug Fixes

  • handle case where stdout.columns can be undefined (437cb2d)
  • handle case where whitespace is a negative value (638c457)
  • handle NaN value case (619a3a8)
  • use poppinss/colors as styleText is not widely supported (2a491ec)

Features

  • add dumper and upgrade edge.js with new stacks functionality (f6e05ba)
  • improve dd output and add edge plugin (9b18e6a)

Full Changelog: adonisjs/core@v6.13.1...v6.14.0

v6.13.1: Keep APP_KEY as an empty value within the .env.example file

Compare Source

What's Changed

  • fix(commands) : make the APP_KEY an empty value for the .env.example file by @​AbdelMN in #​4722

New Contributors

Full Changelog: adonisjs/core@v6.13.0...v6.13.1

v6.13.0: Use Ace Kernel errorHandler when running commands

Compare Source

Features
  • use kernel errorHandler to handle errors (daa475e)

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.12.1...v6.13.0

v6.12.1: Allow bun and pnpm@6 when using "ace add" command

Compare Source

  • chore: run tests before publishing package (5bf81d0)
  • fix: add command to allow bun and pnpm@​6 (2e74375)
  • chore: update dependencies (8cc09c2)

Full Changelog: adonisjs/core@v6.12.0...v6.12.1

v6.12.0: Update health checks setup and add support for bun to install dependencies

Compare Source

  • chore: upgrade to latest version of health checks (00bbbd6)
  • chore: add bun support for ace add (#​4607) (57a81f7)
  • feat: create health checks controller when configuring health checks (f494c52)

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.11.0...v6.12.0

v6.11.0: Add support for configuring health checks via configure command

Compare Source

Run the following command with the latest release to configure health checks

node ace configure health_checks

Commits

  • feat: add support to configure health checks via configure command (6fc19a3)
  • chore: update dependencies (dede44f)

v6.10.1: Fix publish path of health checks module

Compare Source

  • fix: path of health module (d0ad21d)

Full Changelog: adonisjs/core@v6.10.0...v6.10.1

v6.10.0: Add and export health module

Compare Source

This release introduces the new health module. The docs will follow soon.

Commits

  • feat: add and export health module (bce2b76)
  • chore: update dependencies (0cc018e)

Full Changelog: adonisjs/core@v6.9.1...v6.10.0

v6.9.1: Stable assembler hooks

Compare Source

Changes

  • Assembler hooks are now stabilized. See the upgrade guide here. The unstable_assembler property is retained for backwards compatibility, but will be removed in a future minor release.
  • node ace add now support Yarn Berry

Commits

  • chore: update dependencies (430482f)
  • refactor: move to stable assembler hooks (bb24b7f)
  • chore: update dependencies (f00fd9a)
  • chore(commands): continue by default installation of packages (c48e72b)
  • fix: yarn berry support (#​4586) (bdda97a)

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.9.0...v6.9.1

v6.9.0: Add env:add command to define environment variable and its validation rules

Compare Source

  • Merge pull request #​4533 from adonisjs/feat/set-env (c8251b5)
  • fix: fix breaking test (d80d7bf)
  • refactor: defineEnvVariables with omitFromExample (9cd7183)
  • feat: insert empty example in the .env.example (5a1a4e9)
  • feat: add env:add command (4508128)

Full Changelog: adonisjs/core@v6.9.0...v6.9.0

v6.8.0: Moving HMR out of experimental phase

Compare Source

The support for HMR is now stable and you can start using it. For existing projects, you must upgrade the @adonisjs/core and the @adonisjs/assembler packages to their latest releases before you can start using the HMR mode.

This is what you need to do.

npm i -D hot-hook @adonisjs/assembler@latest
npm i @adonisjs/core@latest

Next update the package.json file with the following configuration

"hotHook": {
    "boundaries": [
      "./app/controllers/**/*.ts",
      "./app/middlewares/*.ts"
    ]
  }

And start the HTTP server as follows.

node ace serve --hmr

If you use npm scripts, then make sure to update the dev script as well in the package.json file.

{
  "scripts": {
    "dev": "node ace serve --hmr"
  }
}

Commits

  • chore: update dependencies (c370640)
  • refactor: move from --unstable-hmr to --hmr (40a85f9)

Full Changelog: adonisjs/core@v6.7.1...v6.8.0

v6.7.1: Add a specific citgm script

Compare Source

Commits

  • chore: update dependencies (ab98096)
  • chore: add a citgm script (51d5c27)

Full Changelog: adonisjs/core@v6.7.0...v6.7.1

v6.7.0: Experimental support for HMR

Compare Source

Alright, so we have finally landed support for HMR in experimental mode. Once you upgrade the @adonisjs/core and the @adonisjs/assembler packages to their latest releases, you can start using the HMR mode.

This is what you need to do.

npm i -D hot-hook @adonisjs/assembler@latest
npm i @adonisjs/core@latest

Next update the package.json file with the following configuration

"hotHook": {
    "boundaries": [
      "./app/controllers/**/*.ts",
      "./app/middlewares/*.ts"
    ]
  }

And start the HTTP server as follows.

node ace serve --unstable-hmr

If you use npm scripts, then make sure to update the dev script as well in the package.json file.

{
  "scripts": {
    "dev": "node ace serve --unstable-hmr"
  }
}

Commits

  • Merge pull request #​4504 from adonisjs/feat/hmr (e472091)
  • refactor: remove unused symbols (fbdae40)
  • chore: update dependencies (4a9d201)
  • Merge branch 'develop' into feat/hmr (9b2aadc)
  • refactor: move to --unstable-hmr flag (cdc266a)
  • test: add test (6c2bff9)
  • feat: add serve --hmr flag (3e11c21)

What's Changed

Full Changelog: adonisjs/core@v6.6.0...v6.7.0

v6.6.0: Upgrade to VineJS 2.0

Compare Source

After this release, you will be forced to upgrade to VineJS@​2.0 in your apps. Even though VineJS had a major release, the breaking changes are related to types only and should not impact your application code at all. So we recommend you to follow VineJS release notes and upgrade it.

Commits

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.5.0...v6.6.0

v6.5.0: OnHttpServerMessage hook

Compare Source

Changes

Added a new onHttpServerMessage hook that can be used to intercept the message sent by your HTTP Server. This hook must be defined in the adonisrc.ts file, like other hooks.

import { defineConfig } from '@adonisjs/core/app';

export default defineConfig({
  unstable_assembler: { 
  	onHttpServerMessage: [() => import('./my_http_server_message_hook.js')] 
  },
})

Commits

  • feat: pass onHttpServerMessage hook from rcFile to assembler DevServer (82ecae3)

Full Changelog: adonisjs/core@v6.4.0...v6.5.0

v6.4.0: Update Env module allowing us to use Identifier

Compare Source

  • chore: remove support for VineJS 2.0 (b49f28f)
  • chore: switch to release-it (0c9216d)
  • chore: update dependencies (2d2bac7)
  • chore: allow to use new VineJS major release (e1d0325)
  • chore: allow to use new VineJS major release (071254f)
  • refactor: pass flags and arguments as array in ace command (df6466d)

v6.3.1: Fix add command

Compare Source

Changes

  • The ace add command was incorrectly available under the name ace install. ace add command is now available

Commits

  • fix: rename node ace install to node ace add 9e5c21e
  • chore: update assembler b377553

Full Changelog: adonisjs/core@v6.3.0...v6.3.1

v6.3.0: New codemods APIs, ace add command, and experimental assembler hooks

Compare Source

Changes

  • We now have a node ace add command which allows you to install and configure a package. In a single command, where before you would have had to do npm install ... then node ace configure .... This will be documented in more detail in the coming days. See adonisjs/v6-docs#44

  • The Codemods API now exposes the getTsMorphProject method, which retrieves an instance of tsmorph. This allows package authors to have direct access to ts-morph when they need to perform more specific modifications in the end-user code. Documentation https://docs.adonisjs.com/guides/scaffolding#gettsmorphproject

  • The Codemods API also introduces two new methods: registerVitePlugin and registerJapaPlugin. See documentation here: https://docs.adonisjs.com/guides/scaffolding#registerviteplugin

  • Added experimental assembler hooks. These hooks must be defined in the adonisrc.ts file and enable certain pieces of code to be executed at specific times during the build or dev server lifecycle. This feature will be useful for the new Vite integration we are experimenting :

     // adonisrc.ts
export default defineConfig({
unstable_assembler: {
  onBuildStart: [
    () => import('@my-package/hooks/build_start')
  ],
  onBuildEnd: [
    () => import('@my-package/hooks/build_end')
  ],
  onSourceFileChanged: [
    () => import('@my-package/hooks/source_file_changed')
  ],
  onDevServerStart: [
    () => import('@my-package/hooks/dev_server_start')
  ],
}
})

Commits

  • ci: use main as reference for test job ee4baba
  • test: fix test that fails when runned locally cf79688
  • ci: remove test job next reference 295061f
  • chore: migrate to husky 9 1ca3b45
  • chore: update dependencies fdd332e
  • chore: update minimum node version e33b342
  • feat: add getTsMorphProject method (#​4414) ee96efe
  • feat: add registerVitePlugin and registerJapaPlugin (#​4412) db03e4c
  • feat: do not run assets bundler when disabled in rc file (#​4429) be6ca03
  • chore: add extraneous package c0a86f3
  • feat: add hooks for build and dev server (#​4428) ca600ce
  • style: lint file f01d683
  • feat: add node ace add command (#​4296) e7c668c
  • fix: description of --api and --resource flags d83e970
  • fix(commands): swapped description in make:controller 8848191

What's Changed

New Contributors

Full Changelog: adonisjs/core@v6.2.3...v6.3.0

v6.2.3: Respect singular CLI flag when creating a new controller

Compare Source

  • fix: respect singular command flag to create singular controller 05d23e8

Full Changelog: adonisjs/core@v6.2.2...v6.2.3

v6.2.2: Add test_utils submodule

Compare Source

  • feat: add @​adonisjs/core/test_utils submodule 9fa0de3
  • chore: update dependencies cdef23a

Full Changelog: adonisjs/core@v6.2.1...v6.2.2

v6.2.1: Add all helpers to REPL context via loadHelpers method

Compare Source

  • refactor: update 'http:server_ready' event payload to include duration f5afe9c
  • feat: add all helpers to repl context via loadHelpers command 1e3d6e4
  • chore: update dependencies 6f60fee

Full Changelog: adonisjs/core@v6.2.0...v6.2.1

v6.2.0

Compare Source

[!WARNING]
During the public release on 24th of January, we will also create a proper changelog with a migration guide from AdonisJS v5 to AdonisJS v6. Even though the new version is public on npm, please do not install it until the migration guide is out.

Please consult the following releases to view the list of breaking changes and new additions.

Commits

What's Changed

New Contributors

Full Changelog: adonisjs/core@v5.9.0...v6.2.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml
Scope: all 4 workspace projects
Progress: resolved 0, reused 1, downloaded 0, added 0
/tmp/renovate/repos/github/RxCP/rxcp/apps/admin:
 ERR_PNPM_FETCH_404  GET https://registry.npmjs.org/@better-typed/hyper-fetch/-/hyper-fetch-1.5.1.tgz: Not Found - 404

This error happened while installing a direct dependency of /tmp/renovate/repos/github/RxCP/rxcp/apps/admin

No authorization header was set for the request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants