chore: audit and patch security vulnerabilities across deps

.changeset/security-deps-audit.md

@@ -0,0 +1,5 @@
+---
+"@inngest/workflow-kit": patch
+---
+
+Address security vulnerabilities in transitive dependencies. No runtime API changes; updates dev/build dependency versions and adds pnpm overrides for transitive packages with known advisories (vite, esbuild, cookie, path-to-regexp, qs, cross-spawn, tmp, minimatch, brace-expansion, picomatch, postcss, ws, @babel/runtime, @babel/helpers, next, uuid). Bumps `inngest` devDep to ^3.54.2 (fixes GHSA env-var disclosure), `@storybook/*` addons to ^8.6.18, `typescript` to ^5.9.3, and `@changesets/cli` to ^2.31.0.

examples/nextjs-blog-cms/app/actions.ts

@@ -5,7 +5,7 @@ import { createClient } from "@/lib/supabase/server";
 import { type Workflow } from "@/lib/supabase/types";
 
 export const sendBlogPostToReview = async (id: string) => {
-  const supabase = createClient();
+  const supabase = await createClient();
   await supabase
     .from("blog_posts")
     .update({
@@ -32,7 +32,7 @@ export const approveBlogPostAiSuggestions = async (id: string) => {
 };
 
 export const publishBlogPost = async (id: string) => {
-  const supabase = createClient();
+  const supabase = await createClient();
   await supabase
     .from("blog_posts")
     .update({
@@ -49,7 +49,7 @@ export const publishBlogPost = async (id: string) => {
   });
 };
 export const updateWorkflow = async (workflow: Workflow) => {
-  const supabase = createClient();
+  const supabase = await createClient();
   await supabase
     .from("workflows")
     .update({
@@ -59,7 +59,7 @@ export const updateWorkflow = async (workflow: Workflow) => {
 };
 
 export const toggleWorkflow = async (workflowId: number, enabled: boolean) => {
-  const supabase = createClient();
+  const supabase = await createClient();
   await supabase
     .from("workflows")
     .update({

examples/nextjs-blog-cms/app/api/blog-posts/route.ts

@@ -2,7 +2,7 @@ import { createClient } from "@/lib/supabase/server";
 import { NextResponse } from "next/server";
 
 export async function GET() {
-  const supabase = createClient();
+  const supabase = await createClient();
   const { data: blogPosts } = await supabase
     .from("blog_posts")
     .select(

examples/nextjs-blog-cms/app/api/workflows/route.ts

@@ -2,7 +2,7 @@ import { createClient } from "@/lib/supabase/server";
 import { NextResponse } from "next/server";
 
 export async function GET() {
-  const supabase = createClient();
+  const supabase = await createClient();
   const { data: workflows } = await supabase
     .from("workflows")
     .select("*")

examples/nextjs-blog-cms/app/automation/[id]/page.tsx

@@ -7,13 +7,14 @@ export const runtime = "edge";
 export default async function Automation({
   params,
 }: {
-  params: { id: string };
+  params: Promise<{ id: string }>;
 }) {
-  const supabase = createClient();
+  const { id } = await params;
+  const supabase = await createClient();
   const { data: workflow } = await supabase
     .from("workflows")
     .select("*")
-    .eq("id", params.id!)
+    .eq("id", id!)
     .single();
   if (workflow) {
     return <AutomationEditor workflow={workflow} />;

examples/nextjs-blog-cms/app/blog-post/[id]/page.tsx

@@ -16,8 +16,13 @@ import { mdxComponents } from "@/lib/mdxComponents";
 
 export const revalidate = 0;
 
-export default async function BlogPost({ params }: { params: { id: string } }) {
-  const blogPost = await loadBlogPost(params.id);
+export default async function BlogPost({
+  params,
+}: {
+  params: Promise<{ id: string }>;
+}) {
+  const { id } = await params;
+  const blogPost = await loadBlogPost(id);
 
   if (blogPost) {
     const { default: MDXBlogPostContent } = await evaluate(

examples/nextjs-blog-cms/eslint.config.mjs

@@ -0,0 +1,14 @@
+import nextPlugin from "eslint-config-next";
+import nextTypescript from "eslint-config-next/typescript";
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+
+const config = [
+  ...(Array.isArray(nextPlugin) ? nextPlugin : [nextPlugin]),
+  ...(Array.isArray(nextCoreWebVitals) ? nextCoreWebVitals : [nextCoreWebVitals]),
+  ...(Array.isArray(nextTypescript) ? nextTypescript : [nextTypescript]),
+  {
+    ignores: [".next/**", "node_modules/**", "supabase/**"],
+  },
+];
+
+export default config;

examples/nextjs-blog-cms/lib/inngest/workflowActionHandlers.ts

@@ -33,7 +33,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Add a Table of Contents
     ...actions[0],
     handler: async ({ event, step, workflowAction }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
 
       const blogPost = await step.run("load-blog-post", async () =>
         loadBlogPost(event.data.id)
@@ -86,7 +86,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Perform a grammar review
     ...actions[1],
     handler: async ({ event, step, workflowAction }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
 
       const blogPost = await step.run("load-blog-post", async () =>
         loadBlogPost(event.data.id)
@@ -139,7 +139,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Apply changes after approval
     ...actions[2],
     handler: async ({ event, step }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
 
       const blogPost = await step.run("load-blog-post", async () =>
         loadBlogPost(event.data.id)
@@ -196,7 +196,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Apply changes
     ...actions[3],
     handler: async ({ event, step }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
 
       const blogPost = await step.run("load-blog-post", async () =>
         loadBlogPost(event.data.id)
@@ -219,7 +219,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Generate LinkedIn posts
     ...actions[4],
     handler: async ({ event, step, workflowAction }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
 
       const blogPost = await step.run("load-blog-post", async () =>
         loadBlogPost(event.data.id)
@@ -279,7 +279,7 @@ export const actionsWithHandlers: EngineAction<typeof inngest>[] = [
     // Generate Twitter posts
     ...actions[5],
     handler: async ({ event, step, workflowAction }) => {
-      const supabase = createClient();
+      const supabase = await createClient();
       const numberOfTweets = 2;
 
       const blogPost = await step.run("load-blog-post", async () =>

examples/nextjs-blog-cms/lib/loaders/blog-post.ts

@@ -2,7 +2,7 @@ import { createClient } from "../supabase/server";
 import { BlogPost } from "../supabase/types";
 
 export async function loadBlogPost(id: string): Promise<BlogPost> {
-  const supabase = createClient();
+  const supabase = await createClient();
   const { data: blogPosts } = await supabase
     .from("blog_posts")
     .select(

examples/nextjs-blog-cms/lib/loaders/workflow.ts

@@ -3,7 +3,7 @@ import { Workflow } from "@inngest/workflow-kit";
 import { createClient } from "../supabase/server";
 
 export async function loadWorkflow(event: { name: string }) {
-  const supabase = createClient();
+  const supabase = await createClient();
   const { data } = await supabase
     .from("workflows")
     .select("*", {})

examples/nextjs-blog-cms/lib/supabase/server.ts

@@ -2,8 +2,8 @@ import { createServerClient } from "@supabase/ssr";
 import { cookies } from "next/headers";
 import { Database } from "./types";
 
-export function createClient() {
-  const cookieStore = cookies();
+export async function createClient() {
+  const cookieStore = await cookies();
 
   return createServerClient<Database>(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,

examples/nextjs-blog-cms/package.json

@@ -6,7 +6,7 @@
     "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint"
+    "lint": "eslint . --ext .ts,.tsx,.js,.jsx"
   },
   "dependencies": {
     "@inngest/workflow-kit": "0.1.3-alpha-20240930224141-9a7240323ec48bf95e5725173ab63ae424d76e6b",
@@ -19,12 +19,13 @@
     "@radix-ui/react-switch": "^1.1.0",
     "@radix-ui/react-tabs": "^1.1.0",
     "@supabase/ssr": "^0.5.1",
-    "@supabase/supabase-js": "^2.45.4",
+    "@supabase/supabase-js": "~2.45.4",
+    "@xyflow/react": "^12.1.1",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.1",
     "inngest": "^3.19.14",
     "lucide-react": "^0.441.0",
-    "next": "16.1.5",
+    "next": "^16.2.6",
     "next-mdx-remote": "^6.0.0",
     "openai": "^4.61.0",
     "react": "^18",
@@ -33,16 +34,24 @@
     "remark-html": "^16.0.1",
     "swr": "^2.2.5",
     "tailwind-merge": "^2.5.2",
-    "tailwindcss-animate": "^1.0.7"
+    "tailwindcss-animate": "^1.0.7",
+    "zod": "^3.25.76"
   },
   "devDependencies": {
     "@types/node": "^20",
     "@types/react": "^18",
     "@types/react-dom": "^18",
-    "eslint": "^8",
-    "eslint-config-next": "16.1.5",
-    "postcss": "^8",
+    "eslint": "^9",
+    "eslint-config-next": "^16.2.6",
+    "postcss": "^8.5.10",
     "tailwindcss": "^3.4.1",
     "typescript": "^5"
+  },
+  "pnpm": {
+    "overrides": {
+      "postcss@<8.5.10": "^8.5.10",
+      "underscore@<1.13.8": "^1.13.8",
+      "@supabase/auth-js@<2.70.0": "^2.70.0"
+    }
   }
 }