chore: prepare release v2.3.2

[kasumi-oboroge]

Summary

• Prepare patch release v2.3.2 from main
• Include updater/artifact fix, dependency audit fixes, security hardening, and backend reliability fixes
• Bump web/server/desktop/Tauri/Cargo versions to 2.3.2 and update CHANGELOG

Included fixes

• fix: resolve dependency audit vulnerabilities #169 dependency audit vulnerabilities
• fix: セキュリティ監査で発見された脆弱性を修正 (#148) #153 / [セキュリティ] 本番レベル監査で発見された重大な脆弱性の修正 #148 security audit hardening
• fix: バックエンドの信頼性バグを修正 (#149) #154 / [バックエンド] 実行エンジン・シャットダウン周りの信頼性バグ修正 #149 backend reliability and graceful shutdown improvements
• fix: macOS の Auto-Updater が機能するよう bundle.targets に "app" を追加 #161 macOS updater artifact generation fix
• chore: バージョンを 2.3.1 に統一しリリース手順 doc を更新 (Issue #1) #162 desktop version consistency follow-up

Verification

• npm audit --json at repo root: 0 vulnerabilities
• npm audit --json in apps/web: 0 vulnerabilities
• bun audit in apps/server-ts: passed
• npm test: 119 pass, 0 fail
• npm run lint: passed with existing warnings only
• npm run build: passed
• bun run typecheck in apps/server-ts: passed
• npm run prepare-runtime in apps/desktop: passed
• Sidecar smoke: server and server-x86_64-unknown-linux-gnu served /health, /, and /api/plugins

Notes

• cargo is not installed in this sandbox, so a full local tauri build was not run here. CI/release runners should cover native packaging.
• v2.3.1 macOS users may need a one-time manual download because the v2.3.1 updater metadata did not include macOS artifacts. v2.3.2 should restore updater behavior for later releases.

Summary by CodeRabbit

• New Features

  • HTTP request plugin now enforces redirect limits, response size caps, and blocks requests to private/local addresses.
  • Server implements graceful shutdown with workflow cleanup and database closure.

• Bug Fixes

  • Fixed macOS auto-updater artifact generation affecting 2.3.1 users.
  • Resolved prototype pollution vulnerability.
  • Enhanced workflow payload validation and error handling.
  • Multiple security dependency updates.

• Chores

  • Bumped version to 2.3.2 across all applications.
  • Updated dependencies and security configurations.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ef91039e-8acd-4955-932a-0680c9c1fbf0

📥 Commits

Reviewing files that changed from the base of the PR and between e01440e and d0ad1af.

⛔ Files ignored due to path filters (5)

• apps/desktop/package-lock.json is excluded by !**/package-lock.json
• apps/desktop/src-tauri/Cargo.lock is excluded by !**/*.lock
• apps/server-ts/bun.lock is excluded by !**/*.lock
• apps/web/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (16)

• CHANGELOG.md
• apps/desktop/package.json
• apps/desktop/src-tauri/Cargo.toml
• apps/desktop/src-tauri/tauri.conf.json
• apps/server-ts/package.json
• apps/server-ts/src/db/database.ts
• apps/server-ts/src/engine/executor.ts
• apps/server-ts/src/index.ts
• apps/server-ts/src/routes/workflows.ts
• apps/web/package.json
• package.json
• packages/sdk-ts/src/context.ts
• plugins/http-request/manifest.json
• plugins/http-request/node.ts
• tests/routes/workflows.test.ts
• tests/sdk/context.test.ts

---

📝 Walkthrough

Walkthrough

Version 2.3.2 consolidates security fixes for prototype pollution, HTTP request hardening (SSRF/DoS), server graceful shutdown, and improved workflow validation. All workspace versions and dependencies are updated; desktop CSP policy is explicitly configured.

Changes

Security Release 2.3.2

Layer / File(s)	Summary
Release version 2.3.2 and changelog CHANGELOG.md, apps/desktop/package.json, apps/desktop/src-tauri/Cargo.toml, apps/desktop/src-tauri/tauri.conf.json, apps/server-ts/package.json, apps/web/package.json	All workspace package versions are bumped to 2.3.2 with changelog documenting security fixes including prototype pollution mitigation, SSRF/DoS prevention, graceful shutdown, and workflow validation improvements.
Desktop Content Security Policy apps/desktop/src-tauri/tauri.conf.json	Tauri configuration app.security.csp is set from null to an explicit Content Security Policy string restricting script/style/resource sources and preventing framing and object embedding.
Prototype pollution protection packages/sdk-ts/src/context.ts, apps/server-ts/src/engine/executor.ts, tests/sdk/context.test.ts	NodeContext.updateCharacter is hardened against prototype pollution by filtering update keys via iteration and skipping __proto__, constructor, and prototype entries; guard test confirms pollution is prevented.
HTTP request security hardening plugins/http-request/manifest.json, plugins/http-request/node.ts	HttpRequestNode blocks SSRF by validating hostnames against private/loopback ranges and only allowing http:/https: URLs; adds configurable redirect hop capping (default 5, max 20) with per-hop re-validation, and enforces response body size limits (default 50MB) via streaming with early abort.
Server graceful shutdown and workflow status apps/server-ts/src/db/database.ts, apps/server-ts/src/index.ts, apps/server-ts/src/engine/executor.ts	New closeDb() function performs SQLite WAL checkpoint and connection close; server startup replaces immediate SIGTERM/SIGINT exit with gracefulShutdown routine that stops running workflows and closes the database within a 10s timeout; background workflow execution failures are recorded to status for observability.
Workflow request validation and sensitive field stripping apps/server-ts/src/routes/workflows.ts, tests/routes/workflows.test.ts	Workflow /import endpoint validates payload against Zod schema with structured error responses; /start endpoint uses c.req.text() and enforces parsed body is a JSON object with explicit field type expectations; sensitive field stripping is generalized to recursively mask nested keys across all node types.
Dependency security updates apps/server-ts/package.json, apps/web/package.json, package.json	Runtime dependencies updated: discord.js, drizzle-orm, hono, obs-websocket-js, openai, and uuid (to ^14.0.0); overrides pin ws, undici, lodash, esbuild, ajv, and postcss for transitive dependency security.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant HttpRequestNode
  participant validateUrl
  participant readLimitedText
  Client->>HttpRequestNode: execute(url, method, body)
  HttpRequestNode->>validateUrl: check URL scheme and hostname
  validateUrl-->>HttpRequestNode: reject SSRF/private hosts or allow
  HttpRequestNode->>HttpRequestNode: build RequestInit, respect maxRedirects
  loop each redirect (hop-limited)
    HttpRequestNode->>HttpRequestNode: re-validate URL per hop
    HttpRequestNode->>readLimitedText: fetch and stream response
    readLimitedText-->>HttpRequestNode: error if exceeds maxResponseBytes
  end
  HttpRequestNode-->>Client: response text with JSON parse

Loading

sequenceDiagram
  participant Process
  participant gracefulShutdown
  participant WorkflowExecutor
  participant Database
  Process->>gracefulShutdown: SIGTERM/SIGINT
  gracefulShutdown->>gracefulShutdown: start 10s timeout
  gracefulShutdown->>WorkflowExecutor: stopWorkflow for each running ID
  WorkflowExecutor-->>gracefulShutdown: allSettled results
  gracefulShutdown->>Database: closeDb (WAL checkpoint + close)
  Database-->>gracefulShutdown: complete
  gracefulShutdown->>Process: exit(0)

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Poem

🐰 A patch release hops into view,
Security fixes, both old and new—
Prototype pollution? No more, mon ami!
HTTP locked down, SSRF-free,
Graceful shutdown bids adieu! 🎉

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/v2.3.2

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint skipped: no ESLint configuration detected in root package.json. To enable, add eslint to devDependencies.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}