Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency @tinacms/cli to v1.6.2 [security] #69

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency @tinacms/cli to v1.6.2 [security] #69

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Sep 3, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@tinacms/cli (source) 1.5.25 -> 1.6.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-45391

Impact

Tina search token leaked via lock file (tina-lock.json) in TinaCMS. Sites building with @​tinacms/cli < 1.6.2 that use a search token are impacted.

If your Tina-enabled website has search setup, you should rotate that key immediately.

Patches

This issue has been patched in @​tinacms/[email protected]

Workarounds

Upgrading, and rotating search token is required for the proper fix.

References

https://github.com/tinacms/tinacms/pull/4758

Release Notes

tinacms/tinacms (@​tinacms/cli)

v1.6.2

Patch Changes

v1.6.1

Patch Changes

v1.6.0

Minor Changes

  • 324950a: Updates Plate Editor to latest version 36.

    • Upgrades all remaining packages Typescript to version ^5
    • Adds Shadcn/ui styles/colours to our tinatailwind config (packages/@&#8203;tinacms/cli/src/next/vite/tailwind.ts)
    • Replaces some lodash deps with either the specific function i.e. lodash.set or implements them in a utility file
    • Updates and removes old version of plate (plate-headless) for latest version ^36
    • Starts removing and cleaning up some of the old Plate code.
Patch Changes

v1.5.53

Patch Changes

v1.5.52

Patch Changes

v1.5.51

Patch Changes

v1.5.50

Patch Changes

v1.5.49

Patch Changes

v1.5.48

Patch Changes

v1.5.47

Patch Changes

v1.5.46

Compare Source

Patch Changes

v1.5.45

Compare Source

Patch Changes

v1.5.44

Compare Source

Patch Changes

v1.5.43

Compare Source

Patch Changes

v1.5.42

Compare Source

Patch Changes

v1.5.41

Compare Source

Patch Changes

v1.5.40

Compare Source

Patch Changes

v1.5.39

Compare Source

Patch Changes
  • 0639228: Add mongodb to deps when using the mongo adapter

v1.5.38

Compare Source

Patch Changes

v1.5.37

Compare Source

Patch Changes

v1.5.36

Compare Source

Patch Changes

v1.5.35

Compare Source

Patch Changes

v1.5.34

Compare Source

Patch Changes
  • 39ce3a5: Fix the name of the read only token in the init process

v1.5.33

Compare Source

Patch Changes
  • a65ca13: ## TinaCMS Self hosted Updates
Changes in the database file
Deprecations and Additions
  • Deprecated: onPut, onDelete, and level arguments in createDatabase.
  • Added: databaseAdapter to replace level.
  • Added: gitProvider to substitute onPut and onDelete.
  • New Package: tinacms-gitprovider-github, exporting the GitHubProvider class.
  • Interface Addition: gitProvider added to @tinacms/graphql.
  • Addition: Generated database client.
Updated database.ts Example
import { createDatabase, createLocalDatabase } from '@&#8203;tinacms/datalayer'
import { MongodbLevel } from 'mongodb-level'
import { GitHubProvider } from 'tinacms-gitprovider-github'

const isLocal = process.env.TINA_PUBLIC_IS_LOCAL === 'true'

export default isLocal
  ? createLocalDatabase()
  : createDatabase({
      gitProvider: new GitHubProvider({
        branch: process.env.GITHUB_BRANCH,
        owner: process.env.GITHUB_OWNER,
        repo: process.env.GITHUB_REPO,
        token: process.env.GITHUB_PERSONAL_ACCESS_TOKEN,
      }),
      databaseAdapter: new MongodbLevel<string, Record<string, any>>({
        collectionName: 'tinacms',
        dbName: 'tinacms',
        mongoUri: process.env.MONGODB_URI,
      }),
      namespace: process.env.GITHUB_BRANCH,
    })
Migrating database.ts
a. Replacing onPut and onDelete with gitProvider
  • GitHubProvider Usage: Replace onPut and onDelete with gitProvider, using the provided GitHubProvider for GitHub.
const gitProvider = new GitHubProvider({
  branch: process.env.GITHUB_BRANCH,
  owner: process.env.GITHUB_OWNER,
  repo: process.env.GITHUB_REPO,
  token: process.env.GITHUB_PERSONAL_ACCESS_TOKEN,
})
  • Custom Git Provider: Implement the GitProvider interface for different git providers.

If you are not using Github as your git provider, you can implement the GitProvider interface to use your own git provider.

class CustomGitProvider implements GitProvider
    async onPut(key: string, value: string)
        // ...

    async onDelete(key: string)
        // ...

const gitProvider = new CustomGitProvider();
b. Renaming level to databaseAdapter
  • Renaming in Code: Change level to databaseAdapter for clarity.
createDatabase({
-    level: new MongodbLevel<string, Record<string, any>>(...),
+    databaseAdapter: new MongodbLevel<string, Record<string, any>>(...),
})
c. createLocalDatabase Function
  • Usage: Implement a local database with the createLocalDatabase function.
import { createLocalDatabase } from '@&#8203;tinacms/datalayer'
createLocalDatabase(port)
d. Consolidated Example
  • Updated database.{ts,js} File:
import { createDatabase, createLocalDatabase, GitHubProvider } from '@&#8203;tinacms/datalayer';
import { MongodbLevel } from 'mongodb-level';
const isLocal = process.env.TINA_PUBLIC_IS_LOCAL === 'true';
export default isLocal
  ? createLocalDatabase()
  : createDatabase({
      gitProvider: new GitHubProvider(...),
      databaseAdapter: new MongodbLevel<string, Record<string, any>>(...),
    });
Summary of Authentication Updates in Config
a. AuthProvider and AbstractAuthProvider
  • New: authProvider in defineConfig.
  • Class: AbstractAuthProvider for extending new auth providers.
  • Clerk Auth Provider: New provider added.
  • Renaming: admin.auth to admin.authHooks.
  • Deprecation: admin.auth.
b. Auth Provider in Internal Client and Config
  • Transition: From auth functions to authProvider class.
c. Migration for Authentication
  • Previous API:
defineConfig({
  admin: {
    auth: {
      login() {},
      logout() {},
      //...
    },
  },
  //...
})
  • New API:
import { AbstractAuthProvider } from 'tinacms'
class CustomAuthProvider extends AbstractAuthProvider {
  login() {}
  logout() {}
  //...
}
defineConfig({
  authProvider: new CustomAuthProvider(),
  //...
})
TinaCMS Self Hosted backend updates

  • New: TinaNodeBackend is exported from @tinacms/datalayer. This is used to host the TinaCMS backend in a single function.

  • New: LocalBackendAuthProvider is exported from @tinacms/datalayer. This is used to host the TinaCMS backend locally.

  • New: AuthJsBackendAuthProvider is exported from tinacms-authjs. This is used to host the TinaCMS backend with AuthJS.

Migrating the TinaCMS backend

Now, instead of hosting the in /tina/api/gql.ts file, the entire TinaCMS backend (including auth) will be hosted in a single backend function.

/api/tina/[...routes].{ts,js}

import { TinaNodeBackend, LocalBackendAuthProvider } from '@&#8203;tinacms/datalayer'

import { TinaAuthJSOptions, AuthJsBackendAuthProvider } from 'tinacms-authjs'

import databaseClient from '../../../tina/__generated__/databaseClient'

const isLocal = process.env.TINA_PUBLIC_IS_LOCAL === 'true'

const handler = TinaNodeBackend({
  authProvider: isLocal
    ? LocalBackendAuthProvider()
    : AuthJsBackendAuthProvider({
        authOptions: TinaAuthJSOptions({
          databaseClient: databaseClient,
          secret: process.env.NEXTAUTH_SECRET,
        }),
      }),
  databaseClient,
})

export default (req, res) => {
  // Modify the request here if you need to
  return handler(req, res)
}

These changes are put in place to make self hosted TinaCMS easier to use and more flexible.

Please check out the docs for more information on self hosted TinaCMS.

v1.5.32

Compare Source

Patch Changes

v1.5.31

Compare Source

Patch Changes

v1.5.30

Compare Source

Patch Changes

v1.5.29

Compare Source

Patch Changes

v1.5.28

Compare Source

Patch Changes

v1.5.27

Compare Source

Patch Changes

v1.5.26

Compare Source

Patch Changes

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@netlify Netlify
Copy link

netlify bot commented Sep 3, 2024 •
edited
Loading

❌ Deploy Preview for tgmarinho failed.

Name Link
🔨 Latest commit f4d7518
🔍 Latest deploy log https://app.netlify.com/sites/tgmarinho/deploys/66d794abfeebb200095d15e2

@renovate renovate bot changed the title fix(deps): update dependency @tinacms/cli to v1.6.2 [security] fix(deps): update dependency @tinacms/cli to v1.6.2 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-tinacms-cli-vulnerability branch December 8, 2024 18:57
@renovate renovate bot changed the title fix(deps): update dependency @tinacms/cli to v1.6.2 [security] - autoclosed fix(deps): update dependency @tinacms/cli to v1.6.2 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
@renovate renovate bot force-pushed the renovate/npm-tinacms-cli-vulnerability branch from ae19ce8 to f4d7518 Compare December 8, 2024 23:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
type: dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants