Upgrade multiple dependencies and node version#2754
Merged
Conversation
Piumal1999
requested review from
AnuGayan,
Arshardh,
CrowleyRajapakse,
HeshanSudarshana,
HiranyaKavishani,
Induwara04,
Krishanx92,
PasanT9,
RakhithaRR,
Tharsanan1,
Thushani-Jayasekera,
VirajSalaka,
ashera96,
chamilaadhi,
dushaniw,
hisanhunais,
lasanthaS,
malinthaprasan,
pubudu538,
renuka-fernando,
senthuran16,
tgtshanika,
tharikaGitHub,
tharindu1st and
thivindu
as code owners
July 19, 2026 13:50
Contributor
📝 WalkthroughWalkthroughThe Developer Portal moves to Node.js 24, updates dependencies and package metadata, adds YAML and JWT compatibility utilities, modernizes JWT handling, introduces flat ESLint configuration, and adapts routing for Express 5. ChangesDeveloper Portal modernization
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Request
participant AuthMiddleware
participant PlatformJwt
participant Jose
Request->>AuthMiddleware: provide access or platform token
AuthMiddleware->>PlatformJwt: verifyPlatformJwtClaims or safeDecodeJwt
PlatformJwt->>Jose: jwtVerify or decodeJwt
Jose-->>PlatformJwt: JWT payload
PlatformJwt-->>AuthMiddleware: claims and scopes
AuthMiddleware-->>Request: continue authentication flow
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
VirajSalaka
reviewed
Jul 20, 2026
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
portals/developer-portal/src/utils/platformJwt.js (1)
32-40: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAvoid polymorphic verify-or-decode functions.
Functions that dynamically switch between verifying and purely decoding a JWT based on the presence of a secret parameter are a common source of authentication bypass vulnerabilities (e.g., if a caller accidentally passes a falsy value when a config value is missing).
Consider splitting this into two explicit functions:verifyPlatformJwtClaims(token, secret)anddecodePlatformJwtClaims(token)to prevent accidental misuse.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/developer-portal/src/utils/platformJwt.js` around lines 32 - 40, Replace the polymorphic extractPlatformJwtClaims function with explicit verifyPlatformJwtClaims(token, secret) and decodePlatformJwtClaims(token) functions. Keep JWT verification, including the HS256 restriction, only in the verify function, and keep decoding only in the decode function; update callers to choose the intended operation explicitly rather than branching on a falsy secret.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@portals/developer-portal/src/middlewares/authMiddleware.js`:
- Around line 164-167: Update the authentication logic around
extractPlatformJwtClaims so a missing or falsy config.platformApi.jwtSecret
immediately returns { valid: false, scopes: '' } rather than decoding the token
without verification. Only call extractPlatformJwtClaims and accept claims when
a configured secret is present, preserving invalid-token handling for configured
secrets.
In `@portals/developer-portal/src/utils/platformJwt.js`:
- Around line 35-37: Replace the shared-secret HS256 verification in the
jwtVerify call within platform JWT handling with asymmetric-key verification,
explicitly restricting algorithms to the approved asymmetric set such as RS256,
RS384, RS512, PS256, or EdDSA; never permit none or any HS* algorithm, and
update key loading to use the corresponding asymmetric public key.
---
Nitpick comments:
In `@portals/developer-portal/src/utils/platformJwt.js`:
- Around line 32-40: Replace the polymorphic extractPlatformJwtClaims function
with explicit verifyPlatformJwtClaims(token, secret) and
decodePlatformJwtClaims(token) functions. Keep JWT verification, including the
HS256 restriction, only in the verify function, and keep decoding only in the
decode function; update callers to choose the intended operation explicitly
rather than branching on a falsy secret.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9cacbc9e-b86d-4e4e-a418-6377d8574bea
⛔ Files ignored due to path filters (2)
portals/developer-portal/it/rest-api/package-lock.jsonis excluded by!**/package-lock.jsonportals/developer-portal/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (32)
portals/developer-portal/.nvmrcportals/developer-portal/Dockerfileportals/developer-portal/Makefileportals/developer-portal/README.mdportals/developer-portal/it/docker-compose.test.postgres.yamlportals/developer-portal/it/docker-compose.test.yamlportals/developer-portal/it/rest-api/package.jsonportals/developer-portal/package.jsonportals/developer-portal/src/app.jsportals/developer-portal/src/controllers/apiContentController.jsportals/developer-portal/src/controllers/apiWorkflowsController.jsportals/developer-portal/src/controllers/authController.jsportals/developer-portal/src/controllers/devportalController.jsportals/developer-portal/src/dao/subscriptionPlanDao.jsportals/developer-portal/src/middlewares/authMiddleware.jsportals/developer-portal/src/middlewares/ensureAuthenticated.jsportals/developer-portal/src/middlewares/passportConfig.jsportals/developer-portal/src/routes/api/devportalApiRouter.jsportals/developer-portal/src/routes/pages/apiContentRoute.jsportals/developer-portal/src/routes/pages/customPageRoute.jsportals/developer-portal/src/routes/pages/designModeRoute.jsportals/developer-portal/src/services/adminService.jsportals/developer-portal/src/services/apiMetadataService.jsportals/developer-portal/src/services/apiWorkflowService.jsportals/developer-portal/src/services/keyManagerService.jsportals/developer-portal/src/services/mcpRegistryService.jsportals/developer-portal/src/utils/apiDefinitionUtil.jsportals/developer-portal/src/utils/jwtDecode.jsportals/developer-portal/src/utils/platformJwt.jsportals/developer-portal/src/utils/sampleApiLoader.jsportals/developer-portal/src/utils/util.jsportals/developer-portal/src/utils/yaml.js
💤 Files with no reviewable changes (1)
- portals/developer-portal/src/utils/util.js
Piumal1999
changed the title
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
portals/developer-portal/src/middlewares/registerPartials.js (1)
108-108: 🩺 Stability & Availability | 🔴 Critical | ⚡ Quick winPrevent fall-through to the next middleware after an error.
Calling
next(error)withoutreturncauses the function to continue execution and hitnext()on line 111. This double invocation will cause Express to run both the error handler and the next standard route handler, leading to anERR_HTTP_HEADERS_SENTexception when both try to respond to the client.🐛 Proposed fix to return early
- next(error); + return next(error);🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@portals/developer-portal/src/middlewares/registerPartials.js` at line 108, Update the error path in the middleware function containing next(error) to return immediately after forwarding the error, preventing execution from reaching the later next() call. Preserve the existing success path and normal middleware continuation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@portals/developer-portal/src/middlewares/registerPartials.js`:
- Line 108: Update the error path in the middleware function containing
next(error) to return immediately after forwarding the error, preventing
execution from reaching the later next() call. Preserve the existing success
path and normal middleware continuation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 9bb402b8-c7e1-47f2-ba44-400db273031f
⛔ Files ignored due to path filters (1)
portals/developer-portal/package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (58)
portals/developer-portal/.gitignoreportals/developer-portal/eslint.config.mjsportals/developer-portal/it/rest-api/support/fixtures.jsportals/developer-portal/package.jsonportals/developer-portal/src/app.jsportals/developer-portal/src/config/logger.jsportals/developer-portal/src/controllers/apiContentController.jsportals/developer-portal/src/controllers/apiKeysOverviewController.jsportals/developer-portal/src/controllers/apiKeysPageController.jsportals/developer-portal/src/controllers/apiWorkflowsController.jsportals/developer-portal/src/controllers/applicationsContentController.jsportals/developer-portal/src/controllers/authController.jsportals/developer-portal/src/controllers/customContentController.jsportals/developer-portal/src/controllers/devportalController.jsportals/developer-portal/src/controllers/orgContentController.jsportals/developer-portal/src/controllers/subscriptionsContentController.jsportals/developer-portal/src/dao/apiDao.jsportals/developer-portal/src/dao/apiFileDao.jsportals/developer-portal/src/dao/apiKeyDao.jsportals/developer-portal/src/dao/applicationDao.jsportals/developer-portal/src/dao/subscriptionDao.jsportals/developer-portal/src/db/sequelizeConfig.jsportals/developer-portal/src/helpers/handlebarsHelpers.jsportals/developer-portal/src/middlewares/authMiddleware.jsportals/developer-portal/src/middlewares/csrfProtection.jsportals/developer-portal/src/middlewares/ensureAuthenticated.jsportals/developer-portal/src/middlewares/registerPartials.jsportals/developer-portal/src/models/application.jsportals/developer-portal/src/routes/api/devportalApiRouter.jsportals/developer-portal/src/routes/pages/authRoute.jsportals/developer-portal/src/routes/pages/settingsRoute.jsportals/developer-portal/src/scripts/api-keys-overview.jsportals/developer-portal/src/scripts/api-subscription-plans.jsportals/developer-portal/src/scripts/application-api-keys.jsportals/developer-portal/src/scripts/common.jsportals/developer-portal/src/scripts/dev-reload.jsportals/developer-portal/src/scripts/home-particles.jsportals/developer-portal/src/scripts/listing-cards.jsportals/developer-portal/src/scripts/manage-api-workflows.jsportals/developer-portal/src/scripts/mcp-landing.jsportals/developer-portal/src/scripts/mcp-subscription-plans.jsportals/developer-portal/src/scripts/settings-apis.jsportals/developer-portal/src/scripts/settings-keymanagers.jsportals/developer-portal/src/scripts/settings-labels.jsportals/developer-portal/src/scripts/settings-nav.jsportals/developer-portal/src/scripts/settings-organization.jsportals/developer-portal/src/scripts/settings-plans.jsportals/developer-portal/src/scripts/settings-views.jsportals/developer-portal/src/scripts/settings-webhooks.jsportals/developer-portal/src/services/adminService.jsportals/developer-portal/src/services/devportalService.jsportals/developer-portal/src/services/mcpRegistryService.jsportals/developer-portal/src/services/seederService.jsportals/developer-portal/src/services/webhooks/dispatcher.jsportals/developer-portal/src/utils/constants.jsportals/developer-portal/src/utils/platformJwt.jsportals/developer-portal/src/utils/sampleApiLoader.jsportals/developer-portal/src/utils/util.js
💤 Files with no reviewable changes (15)
- portals/developer-portal/src/models/application.js
- portals/developer-portal/src/routes/pages/settingsRoute.js
- portals/developer-portal/src/services/webhooks/dispatcher.js
- portals/developer-portal/src/controllers/orgContentController.js
- portals/developer-portal/src/dao/apiFileDao.js
- portals/developer-portal/src/config/logger.js
- portals/developer-portal/src/services/seederService.js
- portals/developer-portal/src/dao/apiKeyDao.js
- portals/developer-portal/src/helpers/handlebarsHelpers.js
- portals/developer-portal/src/utils/constants.js
- portals/developer-portal/.gitignore
- portals/developer-portal/src/routes/pages/authRoute.js
- portals/developer-portal/src/utils/util.js
- portals/developer-portal/src/utils/sampleApiLoader.js
- portals/developer-portal/src/routes/api/devportalApiRouter.js
🚧 Files skipped from review as they are similar to previous changes (5)
- portals/developer-portal/src/services/mcpRegistryService.js
- portals/developer-portal/src/app.js
- portals/developer-portal/src/controllers/apiWorkflowsController.js
- portals/developer-portal/src/controllers/apiContentController.js
- portals/developer-portal/package.json
VirajSalaka
approved these changes
Jul 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Fix #2619
Approach