fix: clear remaining audit failures and fix password-expiry by atharvadeosthale · Pull Request #363 · appwrite/templates

atharvadeosthale · 2026-09-30T10:27:34Z

Clears the remaining Dependency audit failures on main, which block open PRs such as #362. #365 already landed the dependency bumps that this PR first carried, so it is now merged with main and contains only the following changes:

Go: bumps the CI Go toolchain from 1.26.6 to 1.26.9 in audit.yml and build.yml. govulncheck flagged GO-2026-6617 (HPACK encoder race in net/http) in the standard library for both Go templates. It was fixed in 1.26.9.
Node engines: nodemailer 10 needs Node 20+ and @faker-js/faker 10 needs ^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0, so email-contact-form, password-expiry and generate-pdf now declare matching engines.
password-expiry fixes:
- Iterates over the users array of the users.list() response, and pages through every expired user 100 at a time instead of stopping at the first 25.
- Sends each email to the user instead of a hard-coded address.
- Uses MAX_PASSWORD_AGE (days, default 90) as documented, instead of a fixed 1 second.

Test

govulncheck ./... reports no vulnerabilities for go/starter and go/discord-command-bot on Go 1.26.9.
npm audit reports 0 vulnerabilities for email-contact-form and password-expiry after the lockfiles were regenerated.
Ran the password-expiry handler against a mocked Appwrite API with 230 expired users. It made 3 users.list() calls (100, 100, 30), attempted an email to all 230, and queried with a cutoff 90 days back.

hansi-codes · 2026-09-30T10:28:35Z

🟢 Tier S · Ready to merge

The earlier pagination finding is fixed, and the latest changes introduce no remaining issue.

This PR updates the Go versions used by CI and aligns the affected Node templates’ engine declarations and lockfiles with their dependencies. It also updates password-expiry to use its configured age, email each returned user, and page through all matching users; its README example is corrected as well.

Latest changes: The latest commits add cursor-based pagination to password-expiry user lookup and align generate-pdf’s Node engine range with Faker’s supported versions.

Verdict	New comments	Fixed	Still open
✅ Approved	0	1	0

📂 Walkthrough · 10

File	Change
`.github/workflows/audit.yml`	Updates the Go toolchain used by dependency-audit jobs.
`.github/workflows/build.yml`	Updates the Go toolchain used by build jobs.
`node/email-contact-form/package.json`	Declares the Node version required by its dependency.
`node/email-contact-form/package-lock.json`	Refreshes the template dependency lockfile.
`node/generate-pdf/package.json`	Aligns the Node engine range with Faker’s supported versions.
`node/generate-pdf/package-lock.json`	Refreshes the lockfile and records the aligned engine range.
`node/password-expiry/README.md`	Corrects the documented MAX_PASSWORD_AGE example.
`node/password-expiry/package.json`	Declares the Node version required by its dependencies.
`node/password-expiry/package-lock.json`	Refreshes the template dependency lockfile.
`node/password-expiry/src/main.js`	Uses the configured expiry age, emails returned users, and paginates through expired users.

✅ Fixed since the last review · 1

~~Only the first page of expired users is processed~~ · node/password-expiry/src/main.js:25

_{Reviewed the commits since c83778d · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

hansi-codes

🟡 Tier B · 1 blocking finding to address. Summary

greptile-apps · 2026-09-30T10:30:56Z

Confidence Score: 5/5

[High risk] Updates dependency versions across multiple projects.

The PR appears safe to merge, with a non-blocking Node 23 engine-range mismatch worth correcting.

Findings

Unsupported Node 23 versions ▶
Node 22 requirement lacks minimum ▶

Fix with agent prompt

### Issue 1
node/generate-pdf/package.json:18
The new engine range accepts Node 23.0–23.4, but the locked Faker dependency requires Node 23.5 or later. Installing on one of those versions produces a dependency engine warning, or fails if engine checks are enforced. The template’s declared range should match the dependency’s supported versions.

```suggestion
    "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0"
```

### Issue 2
node/generate-pdf/README.md:undefined-23
The README says this template runs on Node 22, but the new Faker dependency requires Node 22.13.0 or later. Readers choosing an earlier 22.x runtime would reasonably expect it to be supported when it does not meet the dependency’s stated requirement.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR updates dependency manifests and lockfiles to address audit advisories, documents newer Node runtimes, and corrects password-expiry reminder selection and recipients.

The new PDF template engine declaration accepts a narrow Node 23 range that its Faker dependency does not support.

_{Reviews (2) · Last reviewed commit: "fix: honor MAX_PASSWORD_AGE and declare ..."}

greptile-apps · 2026-09-30T10:30:59Z

 | Setting           | Value         |
 | ----------------- | ------------- |
-| Runtime           | Node (18.0)   |
+| Runtime           | Node (22)     |


Node 22 requirement lacks minimum The README says this template runs on Node 22, but the new Faker dependency requires Node 22.13.0 or later. Readers choosing an earlier 22.x runtime would reasonably expect it to be supported when it does not meet the dependency’s stated requirement.

Prompt To Fix With AI

This is a comment left during a code review. Path: node/generate-pdf/README.md Line: 23 Comment: **Node 22 requirement lacks minimum** The README says this template runs on Node 22, but the new Faker dependency requires Node 22.13.0 or later. Readers choosing an earlier 22.x runtime would reasonably expect it to be supported when it does not meet the dependency’s stated requirement. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

hansi-codes

🟢 Tier S · Looks good to merge. Summary

greptile-apps · 2026-09-30T10:36:02Z

    "prettier": "^3.2.5"
+  },
+  "engines": {
+    "node": "^20.19.0 || >=22.13.0"


Unsupported Node 23 versions The new engine range accepts Node 23.0–23.4, but the locked Faker dependency requires Node 23.5 or later. Installing on one of those versions produces a dependency engine warning, or fails if engine checks are enforced. The template’s declared range should match the dependency’s supported versions.

Suggested change

"node": "^20.19.0 || >=22.13.0"

"node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0"

Prompt To Fix With AI

This is a comment left during a code review. Path: node/generate-pdf/package.json Line: 18 Comment: **Unsupported Node 23 versions** The new engine range accepts Node 23.0–23.4, but the locked Faker dependency requires Node 23.5 or later. Installing on one of those versions produces a dependency engine warning, or fails if engine checks are enforced. The template’s declared range should match the dependency’s supported versions. ```suggestion "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0" ``` --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

# Conflicts: # node/email-contact-form/package-lock.json # node/email-contact-form/package.json # node/password-expiry/package-lock.json # node/password-expiry/package.json

hansi-codes

🟡 Tier B · 1 blocking finding to address. Summary

hansi-codes

🟢 Tier S · Looks good to merge. Summary

atharvadeosthale added 2 commits September 30, 2026 12:27

fix(password-expiry): iterate over the users in the list response

967c0b6

chore: fix npm audit advisories in Node templates

9c9a1df

hansi-codes Bot requested changes Sep 30, 2026

View reviewed changes

Comment thread node/password-expiry/src/main.js Outdated

Comment thread node/password-expiry/package.json Outdated

greptile-apps Bot reviewed Sep 30, 2026

View reviewed changes

atharvadeosthale added 2 commits September 30, 2026 12:31

fix(password-expiry): email each user and require Node 20

f7f94f4

chore: fix audit advisories in Bun and Rust templates

ca46d2e

atharvadeosthale changed the title ~~chore: fix npm audit advisories in Node templates~~ chore: fix dependency audit advisories Sep 30, 2026

hansi-codes Bot approved these changes Sep 30, 2026

View reviewed changes

fix: honor MAX_PASSWORD_AGE and declare Node engines

a957c10

greptile-apps Bot reviewed Sep 30, 2026

View reviewed changes

atharvadeosthale added 2 commits October 13, 2026 11:12

Merge remote-tracking branch 'origin/main' into fix/npm-audit

178deae

# Conflicts: # node/email-contact-form/package-lock.json # node/email-contact-form/package.json # node/password-expiry/package-lock.json # node/password-expiry/package.json

ci: bump Go to 1.26.9 for GO-2026-6617

c83778d

atharvadeosthale force-pushed the fix/npm-audit branch from 623b2f6 to c83778d Compare October 13, 2026 05:42

atharvadeosthale changed the title ~~chore: fix dependency audit advisories~~ fix: clear remaining audit failures and fix password-expiry Oct 13, 2026

hansi-codes Bot requested changes Oct 13, 2026

View reviewed changes

Comment thread node/password-expiry/src/main.js Outdated

atharvadeosthale added 2 commits October 13, 2026 11:19

fix(password-expiry): page through all users with expired passwords

cf59283

fix(generate-pdf): match faker's supported Node versions in engines

f6448a5

hansi-codes Bot approved these changes Oct 13, 2026

View reviewed changes

atharvadeosthale merged commit a1f7e7f into main Oct 13, 2026
28 checks passed

atharvadeosthale deleted the fix/npm-audit branch October 13, 2026 05:55

Navigation Menu

Repository navigation

fix: clear remaining audit failures and fix password-expiry - #363

fix: clear remaining audit failures and fix password-expiry#363
atharvadeosthale merged 9 commits into
mainfrom
fix/npm-audit

atharvadeosthale commented Sep 30, 2026 •

edited

Loading

Uh oh!

hansi-codes Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

hansi-codes Bot left a comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot Sep 30, 2026

Uh oh!

hansi-codes Bot left a comment

Uh oh!

greptile-apps Bot Sep 30, 2026

Uh oh!

hansi-codes Bot left a comment

Uh oh!

Uh oh!

hansi-codes Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	"node": "^20.19.0 \|\| >=22.13.0"
	"node": "^20.19.0 \|\| ^22.13.0 \|\| ^23.5.0 \|\| >=24.0.0"

Conversation

atharvadeosthale commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test

Uh oh!

hansi-codes Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Tier S · Ready to merge

Uh oh!

hansi-codes Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Findings

Summary

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

hansi-codes Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 30, 2026

Choose a reason for hiding this comment

Uh oh!

hansi-codes Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

hansi-codes Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

atharvadeosthale commented Sep 30, 2026 •

edited

Loading

hansi-codes Bot commented Sep 30, 2026 •

edited

Loading

greptile-apps Bot commented Sep 30, 2026 •

edited

Loading