fix: resolve dependabot security alerts and fix templates for toml 4

Dependencies: - app: react-router-dom ^7.18.0, vite ^6.4.3, yaml 2.8.3 - app (transitive, lockfile only): postcss 8.5.28, nanoid 3.3.19, picomatch 2.3.2/4.0.7, browserslist 4.29.2, rollup 4.63.5, @babel/core 7.29.7, @babel/runtime 7.29.7 - build-scripts: toml 4.2.0 (matches Dokploy/dokploy#5517), yaml 2.8.3 Templates rejected by toml 4's strict parsing (Dokploy fetches template.toml from this repo at runtime, so they would fail there once #5517 ships): - signoz, supabase: write invalid escape sequences (\{ \$ \( \s ...) as \\ so the parsed value keeps the literal backslash exactly as toml 3 produced it - timescaledb, valkey: drop `mounts = []` redefined by [[config.mounts]] Parsed output is deep-equal to before under toml 3 for all 532 templates.
2026-11-10 01:33:12 -06:00 · 2026-09-29 11:12:00 -04:00
9 changed files with 388 additions and 317 deletions
@@ -35,13 +35,13 @@
    "next-themes": "^0.4.6",
    "react": "^19.2.0",
    "react-dom": "^19.2.0",
-    "react-router-dom": "^7.9.4",
+    "react-router-dom": "^7.18.0",
    "sonner": "^2.0.7",
    "tailwind-merge": "^3.3.1",
    "tailwindcss": "^4.1.16",
    "tailwindcss-animate": "^1.0.7",
    "vite-plugin-static-copy": "^2.3.2",
-    "yaml": "2.7.1",
+    "yaml": "2.8.3",
    "zustand": "^5.0.8"
  },
  "devDependencies": {
@@ -51,6 +51,6 @@
    "@vitejs/plugin-react": "^4.7.0",
    "globals": "^15.15.0",
    "typescript": "~5.7.3",
-    "vite": "^6.4.1"
+    "vite": "^6.4.3"
  }
 }
@@ -472,7 +472,7 @@ content = """
                <my_ad_server>
                    <host>localhost</host>
                    <port>389</port>
-                    <bind_dn>EXAMPLE\{user_name}</bind_dn>
+                    <bind_dn>EXAMPLE\\{user_name}</bind_dn>
                    <user_dn_detection>
                        <base_dn>CN=Users,DC=example,DC=com</base_dn>
                        <search_filter>(&amp;(objectClass=user)(sAMAccountName={user_name}))</search_filter>
@@ -624,14 +624,14 @@ content = """
         To install and run JDBC bridge in background:
         * [Debian/Ubuntu]
           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\\(.*\\)<.*|\\1|')
           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
           apt install --no-install-recommends -f ./clickhouse-jdbc-bridge_$PKG_VER-1_all.deb
           clickhouse-jdbc-bridge &

         * [CentOS/RHEL]
           export MVN_URL=https://repo1.maven.org/maven2/ru/yandex/clickhouse/clickhouse-jdbc-bridge
-           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\(.*\)<.*|\1|')
+           export PKG_VER=$(curl -sL $MVN_URL/maven-metadata.xml | grep '<release>' | sed -e 's|.*>\\(.*\\)<.*|\\1|')
           wget https://github.com/ClickHouse/clickhouse-jdbc-bridge/releases/download/v$PKG_VER/clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
           yum localinstall -y clickhouse-jdbc-bridge-$PKG_VER-1.noarch.rpm
           clickhouse-jdbc-bridge &
@@ -1068,11 +1068,11 @@ content = """
    <query_masking_rules>
        <rule>
            <name>hide encrypt/decrypt arguments</name>
-            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\s*\(\s*(?:'(?:\\'|.)+'|.*?)\s*\)</regexp>
+            <regexp>((?:aes_)?(?:encrypt|decrypt)(?:_mysql)?)\\s*\\(\\s*(?:'(?:\\'|.)+'|.*?)\\s*\\)</regexp>
            <!-- or more secure, but also more invasive:
-                (aes_\w+)\s*\(.*\)
+                (aes_\\w+)\\s*\\(.*\\)
            -->
-            <replace>\1(???)</replace>
+            <replace>\\1(???)</replace>
        </rule>
    </query_masking_rules>

@@ -213,17 +213,17 @@ content = """#!/bin/bash
 # and performs environment variable substitution in the declarative config.

 if [ -n "$SUPABASE_SECRET_KEY" ] && [ -n "$SUPABASE_PUBLISHABLE_KEY" ]; then
-    export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '$SUPABASE_SECRET_KEY' and 'Bearer $SERVICE_ROLE_KEY_ASYMMETRIC') or (headers.apikey == '$SUPABASE_PUBLISHABLE_KEY' and 'Bearer $ANON_KEY_ASYMMETRIC') or headers.apikey)"
-    export LUA_RT_WS_EXPR="\$((query_params.apikey == '$SUPABASE_SECRET_KEY' and '$SERVICE_ROLE_KEY_ASYMMETRIC') or (query_params.apikey == '$SUPABASE_PUBLISHABLE_KEY' and '$ANON_KEY_ASYMMETRIC') or query_params.apikey)"
+    export LUA_AUTH_EXPR="\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or (headers.apikey == '$SUPABASE_SECRET_KEY' and 'Bearer $SERVICE_ROLE_KEY_ASYMMETRIC') or (headers.apikey == '$SUPABASE_PUBLISHABLE_KEY' and 'Bearer $ANON_KEY_ASYMMETRIC') or headers.apikey)"
+    export LUA_RT_WS_EXPR="\\$((query_params.apikey == '$SUPABASE_SECRET_KEY' and '$SERVICE_ROLE_KEY_ASYMMETRIC') or (query_params.apikey == '$SUPABASE_PUBLISHABLE_KEY' and '$ANON_KEY_ASYMMETRIC') or query_params.apikey)"
 else
-    export LUA_AUTH_EXPR="\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)"
-    export LUA_RT_WS_EXPR="\$(query_params.apikey)"
+    export LUA_AUTH_EXPR="\\$((headers.authorization ~= nil and headers.authorization:sub(1, 10) ~= 'Bearer sb_' and headers.authorization) or headers.apikey)"
+    export LUA_RT_WS_EXPR="\\$(query_params.apikey)"
 fi

 awk '{
  result = ""
  rest = $0
-  while (match(rest, /\$[A-Za-z_][A-Za-z_0-9]*/)) {
+  while (match(rest, /\\$[A-Za-z_][A-Za-z_0-9]*/)) {
    varname = substr(rest, RSTART + 1, RLENGTH - 1)
    if (varname in ENVIRON) {
      result = result substr(rest, 1, RSTART - 1) ENVIRON[varname]
@@ -5,7 +5,6 @@ postgres_db = "timescaledb"
 timescaledb_telemetry = "off"

 [config]
-mounts = []

 [config.env]
 POSTGRES_USER = "${postgres_user}"
@@ -5,7 +5,6 @@ valkey_password = "${password:32}"
 env = [
  "VALKEY_PASSWORD=${valkey_password}"
 ]
-mounts = []

 [[config.mounts]]
 filePath = "valkey.conf"
@@ -8,8 +8,8 @@
      "name": "dokploy-templates-build-scripts",
      "version": "1.0.0",
      "dependencies": {
-        "toml": "^3.0.0",
-        "yaml": "2.7.1"
+        "toml": "4.2.0",
+        "yaml": "2.8.3"
      },
      "devDependencies": {
        "@types/node": "^20.0.0",
@@ -553,10 +553,13 @@
      }
    },
    "node_modules/toml": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/toml/-/toml-3.0.0.tgz",
-      "integrity": "sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==",
-      "license": "MIT"
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/toml/-/toml-4.2.0.tgz",
+      "integrity": "sha512-TvAJjbHZlYmI323+srtqHQFyJsoWy6mI09ppkuj9+iRsqsVKG9fvTcOP7FHF2UCb0QSYtjEavffrKzdd0XgClg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      }
    },
    "node_modules/tsx": {
      "version": "4.21.0",
@@ -600,15 +603,18 @@
      "license": "MIT"
    },
    "node_modules/yaml": {
-      "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.1.tgz",
-      "integrity": "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==",
+      "version": "2.8.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.8.3.tgz",
+      "integrity": "sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==",
      "license": "ISC",
      "bin": {
        "yaml": "bin.mjs"
      },
      "engines": {
-        "node": ">= 14"
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
      }
    }
  }
@@ -9,8 +9,8 @@
    "process-meta": "node process-meta.js"
  },
  "dependencies": {
-    "toml": "^3.0.0",
-    "yaml": "2.7.1"
+    "toml": "4.2.0",
+    "yaml": "2.8.3"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
@@ -9,11 +9,11 @@ importers:
  .:
    dependencies:
      toml:
-        specifier: ^3.0.0
-        version: 3.0.0
+        specifier: 4.2.0
+        version: 4.2.0
      yaml:
-        specifier: 2.7.1
-        version: 2.7.1
+        specifier: 2.8.3
+        version: 2.8.3
    devDependencies:
      '@types/node':
        specifier: ^20.0.0
@@ -202,8 +202,9 @@ packages:
  resolve-pkg-maps@1.0.0:
    resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}

-  toml@3.0.0:
-    resolution: {integrity: sha512-y/mWCZinnvxjTKYhJ+pYxwD0mRLVvOtdS2Awbgxln6iEnt4rk0yBxeSBHkGJcPucRiG0e55mwWp+g/05rsrd6w==}
+  toml@4.2.0:
+    resolution: {integrity: sha512-TvAJjbHZlYmI323+srtqHQFyJsoWy6mI09ppkuj9+iRsqsVKG9fvTcOP7FHF2UCb0QSYtjEavffrKzdd0XgClg==}
+    engines: {node: '>=20'}

  tsx@4.21.0:
    resolution: {integrity: sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==}
@@ -218,9 +219,9 @@ packages:
  undici-types@6.21.0:
    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}

-  yaml@2.7.1:
-    resolution: {integrity: sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==}
-    engines: {node: '>= 14'}
+  yaml@2.8.3:
+    resolution: {integrity: sha512-AvbaCLOO2Otw/lW5bmh9d/WEdcDFdQp2Z2ZUH3pX9U2ihyUY0nvLv7J6TrWowklRGPYbB/IuIMfYgxaCPg5Bpg==}
+    engines: {node: '>= 14.6'}
    hasBin: true

 snapshots:
@@ -345,7 +346,7 @@ snapshots:

  resolve-pkg-maps@1.0.0: {}

-  toml@3.0.0: {}
+  toml@4.2.0: {}

  tsx@4.21.0:
    dependencies:
@@ -358,4 +359,4 @@ snapshots:

  undici-types@6.21.0: {}

-  yaml@2.7.1: {}
+  yaml@2.8.3: {}