chore(deps): Bump the npm-dependencies group in /web with 5 updates by dependabot[bot] · Pull Request #207 · Upellift99/GateCHA

dependabot · 2026-10-12T18:23:00Z

Bumps the npm-dependencies group in /web with 5 updates:

Package	From	To
altcha	`3.2.4`	`3.3.0`
vue-router	`5.3.1`	`5.4.0`
happy-dom	`20.14.5`	`20.14.6`
vite	`8.3.2`	`8.3.4`
vue-tsc	`3.3.11`	`3.3.12`

Updates altcha from 3.2.4 to 3.3.0

Release notes

Sourced from altcha's releases.

v3.3.0

This release fixes the widget's proof-of-work code to match the fixed altcha-lib (v2.6.0). It fixes a key-derivation mismatch that caused valid solutions to be rejected, and a verification bypass in altcha/lib. Upgrading is recommended.

Security

verifySolution bypass (altcha/lib). If the challenge had no keySignature, or the verifier passed no hmacKeySignatureSecret, verifySolution re-derived the key from the submitted counter but never checked it against the signed keyPrefix. Any counter, for example 0, together with its derived key verified without doing any work. The derived key must now also match keyPrefix. altcha-lib fixed this in e2a6daf (v2.3.2), but the fix never reached the widget's copy of this code until now.

Obfuscation plugin key exposure. obfuscate() used the published keyPrefix as its AES key. If keyPrefixLength was overridden, part or all of that key could be published. It now encrypts with the full derived key and publishes only half of it. With default options the output format is the same, so existing obfuscated strings still decode.

Fixes

SHA key derivation. Each round now hashes the full digest from the previous round, and the result is cut to keyLength once at the end. This is what altcha-lib and all server ports do. Before, the widget's solutions were rejected (invalidSolution) for SHA-384 or SHA-512 with cost > 1, and for any SHA-* challenge with keyLength below the digest size and cost > 1. The default (SHA-256, keyLength 32) was not affected.

PBKDF2 key length. PBKDF2/* now supports any keyLength. Before, only 16, 24 and 32 worked.

Algorithm names. The built-in deriveKey functions reject names they don't support. Before, unknown PBKDF2/* names fell back to SHA-256, and SCRYPT and ARGON2ID ignored the name. Each function now accepts only its own exact names:

SHA-256, SHA-384, SHA-512

PBKDF2/SHA-256, PBKDF2/SHA-384, PBKDF2/SHA-512

SCRYPT

ARGON2ID

Input validation (altcha/lib):

createChallenge checks cost, keyLength, memoryCost, parallelism, counter, counterMode, expiresAt, hmacAlgorithm and the secrets.

createChallenge also checks the key prefix. keyPrefix must be a non-empty hex string, and it is lowercased before signing. keyPrefixLength must be a positive integer smaller than the derived key.

verifySolution returns invalidSolution for a malformed derivedKey (it must be lowercase hex) or counter (it must be an integer the counter mode can encode), instead of throwing or coercing the value.

solveChallenge throws immediately on an invalid keyPrefix instead of running until the timeout.

hexToBuffer rejects non-hex characters.

Canonical JSON keeps a __proto__ key, so an injected key now breaks the signature.

verifyServerSignature:

checks payload.algorithm against SHA-1, SHA-256, SHA-384 and SHA-512;

requires hmacSecret;

returns invalidSignature when the signature is missing;

checks expiry against the current time without rounding it down to whole seconds, so the up to 1 second of grace is gone.

Upgrade notes

Challenges that are already in flight with these settings will not verify across the upgrade.

Calls that used to work and now throw:

verifySolution without hmacSignatureSecret, or with an empty one.

createChallenge with hmacSignatureSecret: '' or null.

createChallenge with hmacKeySignatureSecret but no hmacSignatureSecret.

createChallenge with an empty or non-hex keyPrefix.

createChallenge with a keyPrefixLength that is not smaller than the derived key.

Any built-in deriveKey with an unsupported algorithm name.

Changelog

Sourced from altcha's changelog.

[3.3.0] - 2026-10-05

Fix: SHA key derivation hashes the full digest each round and truncates once, matching altcha-lib and the server ports (SHA-384/512 and any keyLength below the digest size with cost > 1 previously failed server verification)

Fix: PBKDF2 supports any keyLength (uses deriveBits instead of an AES-GCM key)

Fix: built-in deriveKey functions reject unsupported algorithm names

Fix: verifySolution requires the re-derived key to match the signed keyPrefix, rejects malformed derivedKey/counter values, and validates secrets and hmacAlgorithm

Fix: createChallenge validates its options (keyPrefixLength below the derived key length, non-empty hex keyPrefix lowercased before signing, positive integer cost/keyLength, valid counter and expiresAt)

Fix: solveChallenge fails fast on an invalid keyPrefix

Fix: hexToBuffer rejects non-hex input; canonical JSON keeps __proto__ keys

Fix: verifyServerSignature validates algorithm and hmacSecret, handles a missing signature, and uses exact expiry

Fix: obfuscation plugin encrypts with the full derived key instead of a keyPrefixLength-sized prefix

Commits

1b72074 v3.3.0
a9f393d deps: update vulnerabilities
999d339 fix: align pow library and helpers with fixed in altcha-lib
See full diff in compare view

Updates vue-router from 5.3.1 to 5.4.0

Release notes

Sourced from vue-router's releases.

v5.4.0

   🚨 Breaking Changes

experimental: Normalize query values to arrays - by @posva in vuejs/router#2824 (f1fbc)

   🚀 Features

Accept a prebuilt matcher in createRouter - by @danielroe in vuejs/router#2804 (9de96)

UseScrollRestoration and onRouteRendered - by @posva in vuejs/router#2805 (e3dde)

Diagnose experimental beforeEnter migration - by @posva (b695c)

experimental:

Warn about legacy optional param removal - by @posva in vuejs/router#2818 (c2f92)

Extract hash params with definePage - by @posva (dbf2d)

Configure required and default hash params - by @posva (cef5c)

Never decode the hash, protect-only encoding - by @posva in vuejs/router#2760 (aca2c)

Allow custom regexp for path params in definePage - by @posva in vuejs/router#2822 (3a192)

router:

Restore hashes and top by default - by @posva (7c385)

   🐞 Bug Fixes

Resolve experimental guard redirects against target on history navigation - by @posva (2c5fb)

experimental:

Keep declared case of static prefix in MatcherPatternPathStar.build() - by @contactjawad in vuejs/router#2798 (4dc6b)

Make hash params optional and nullable - by @posva (d9a4c)

Exclude defaults from required hash params - by @posva (346e2)

Align hash parameter parsing with queries - by @posva (cf251)

Keep last hash param instead of throwing - by @posva (d1e8a)

Disallow required with a default for query params - by @posva (f60e9)

Make query params with a default optional on push - by @posva (fb604)

Do not inherit params, query, or hash on redirects - by @posva (02a92)

history:

Invalidate obsolete scroll positions - by @posva and @liuly0322 in vuejs/router#2814 (071f1)

unplugin:

Sanitize named view in definePage import - by @giaBaoJS in vuejs/router#2809 (0711d)

Keep hex character codes in param segments regexp - by @kwy404 in vuejs/router#2811 (07663)

   🏎 Performance

unplugin: Cache merged route overrides - by @posva in vuejs/router#2821 (732b7)

    View changes on GitHub

Commits

596d481 release: vue-router@5.4.0
2970e8e chore: fix back extends
16a62f8 chore(deps): upgrade dependencies (#2828)
b810a7e chore: remove unused types
a0efbde docs: adapt
2c5fbd6 fix: resolve experimental guard redirects against target on history navigation
6ef3163 refactor: allow undefined on optional param
8e89a60 chore: comment
72ceb99 refactor: absolute position
57dd1d6 refactor: allow guards to return relative location
Additional commits viewable in compare view

Updates happy-dom from 20.14.5 to 20.14.6

Release notes

Sourced from happy-dom's releases.

v20.14.6

👷‍♂️ Patch fixes

Fixes cookie scope forgery vulnerability - By @capricorn86

Commits

f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
See full diff in compare view

Updates vite from 8.3.2 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

8.3.3 (2026-10-06)

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Commits

b6c20f6 release: v8.3.4 (#23702)
b28db28 fix(server): match static aliases on path boundaries (#23643)
bc0f21c feat(bundled-dev): support import.meta.hot.acceptExports (#23463)
fa71469 fix(client): skip rewriting unchanged adopted styles (#23697)
2a8c0f0 fix(build): correct preloads when chunkImportMap is enabled with non-root bas...
3a7f2ae fix(html): avoid adding filesystem root to watcher (#23689)
facc2fb fix: remove input option unescaping for now (#23694)
70d56ea fix(dev): a restart requested during a restart used to be dropped (fix #23392...
cf52011 fix(css): resolve imported preprocessors from their file path with lightningc...
fcb6f12 fix: don't treat modules ending with js-like query as js (#23687)
Additional commits viewable in compare view

Updates vue-tsc from 3.3.11 to 3.3.12

Release notes

Sourced from vue-tsc's releases.

v3.3.12

language-core

security: improved handling of untrusted Vue files (cea0698)

feat: infer first parameter type of default factory for defineModel (1be73b8)

feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)

fix: keep union props when using withDefaults (084f30f)

fix: keep inference-only props string single-line with block comments (55ca36f)

fix: support calling template bindings without .value (7ad4a94)

fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)

fix: pad directive hook signatures to check short-arity directive bindings (94052b8)

fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)

fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)

fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)

fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)

perf: precompile attribute glob matchers (7d2e603)

component-meta

fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

fix: prevent watch mode crash on incremental build (a59da36)

vscode

perf: reduce focus mode overhead (b0936d1)

Contributors: @johnsoncodehk, @serkodev, @KazariEX, @00200200, @camonunez, @Cherry, @hungateJoseph, @uturnr, @ValentinYoushkevich, @xia-chao

Changelog

Sourced from vue-tsc's changelog.

3.3.12 (2026-10-02)

language-core

security: improved handling of untrusted Vue files (cea0698)

feat: infer first parameter type of default factory for defineModel (1be73b8)

feat: report duplicate CSS module names, including non-identifier names (d41d919) (ffb85e5)

fix: keep union props when using withDefaults (084f30f)

fix: keep inference-only props string single-line with block comments (55ca36f)

fix: support calling template bindings without .value (7ad4a94)

fix: avoid type guards missing from the tsc bundle in template binding analysis (e743e80)

fix: pad directive hook signatures to check short-arity directive bindings (94052b8)

fix: vueCompilerOptions.plugins now overrides the inherited list instead of being deduplicated on resolve (4fa9e97) (c0e5d2e)

fix: eliminate synthesized ignore comments across codegen, scoped class aliases and compound event handlers (dbcb7de) (eccb74a) (612ae32)

fix: correct template mapping boundaries and eliminate unmapped diagnostics (04954dd) (8c85e38) (af7a194) (90f8207)

fix: stop typedef JSDoc from leaking into emitted dts (d4d4139)

perf: precompile attribute glob matchers (7d2e603)

component-meta

fix: stop checking JS Vue files as TS (045a6a7)

typescript-plugin

fix: don't abort reference span fix-up at style-less files (e46126c)

tsc

fix: prevent watch mode crash on incremental build (a59da36)

vscode

perf: reduce focus mode overhead (b0936d1)

Contributors: @johnsoncodehk, @serkodev, @KazariEX, @00200200, @camonunez, @Cherry, @hungateJoseph, @uturnr, @ValentinYoushkevich, @xia-chao

Commits

cea0698 v3.3.12 (#6234)
d4d4139 fix(language-core): stop typedef jsdoc from leaking into emitted dts
045a6a7 fix(component-meta): stop checking JS Vue files as TS (#6231)
a59da36 fix(tsc): prevent watch mode crash on incremental build (#6213)
94052b8 fix(language-core): pad directive hook signatures to check short-arity direct...
ffb85e5 fix(language-core): report duplicate non-identifier CSS module names (#6199)
d41d919 feat(language-core): report duplicate CSS module names (#6198)
3167acf test(tsc): assert emitted declarations are self-contained and add jsxSlots te...
d797f44 chore(deps): upgrade Vue to 3.6.0-rc.6 (#6189)
04954dd fix(language-core): eliminate unmapped codegen diagnostics (#6179)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm-dependencies group in /web with 5 updates: | Package | From | To | | --- | --- | --- | | [altcha](https://github.com/altcha-org/altcha) | `3.2.4` | `3.3.0` | | [vue-router](https://github.com/vuejs/router) | `5.3.1` | `5.4.0` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.14.5` | `20.14.6` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.2` | `8.3.4` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.11` | `3.3.12` | Updates `altcha` from 3.2.4 to 3.3.0 - [Release notes](https://github.com/altcha-org/altcha/releases) - [Changelog](https://github.com/altcha-org/altcha/blob/main/CHANGELOG.md) - [Commits](altcha-org/altcha@v3.2.4...v3.3.0) Updates `vue-router` from 5.3.1 to 5.4.0 - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v5.3.1...v5.4.0) Updates `happy-dom` from 20.14.5 to 20.14.6 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.14.5...v20.14.6) Updates `vite` from 8.3.2 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `vue-tsc` from 3.3.11 to 3.3.12 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.12/packages/tsc) --- updated-dependencies: - dependency-name: altcha dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: vue-router dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: happy-dom dependency-version: 20.14.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: vue-tsc dependency-version: 3.3.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-12T18:23:09Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 8702a4ec-cb44-4a86-8fba-961a6e17c545

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 12, 2026

Upellift99 merged commit 3910782 into main Oct 12, 2026
11 checks passed

Upellift99 deleted the dependabot/npm_and_yarn/web/npm-dependencies-47c9630011 branch October 12, 2026 21:20

Upellift99 mentioned this pull request Oct 23, 2026

fix(dashboard): unbreak the login captcha (altcha 3.4.0 -> 3.4.1) #229

Merged

Navigation Menu

Repository navigation

chore(deps): Bump the npm-dependencies group in /web with 5 updates - #207

chore(deps): Bump the npm-dependencies group in /web with 5 updates#207
Upellift99 merged 1 commit into
mainfrom
dependabot/npm_and_yarn/web/npm-dependencies-47c9630011

dependabot Bot commented on behalf of github Oct 12, 2026

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 12, 2026

v3.3.0

Security

Fixes

Upgrade notes

[3.3.0] - 2026-10-05

v5.4.0

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v20.14.6

👷‍♂️ Patch fixes

v8.3.4

Features

Bug Fixes

Performance Improvements

Code Refactoring

v8.3.3

Bug Fixes

8.3.4 (2026-10-08)

Features

Bug Fixes

Performance Improvements

Code Refactoring

8.3.3 (2026-10-06)

Bug Fixes

v3.3.12

language-core

component-meta

typescript-plugin

tsc

vscode

3.3.12 (2026-10-02)

language-core

component-meta

typescript-plugin

tsc

vscode

Uh oh!

coderabbitai Bot commented Oct 12, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant