fix: clear remaining audit failures and fix password-expiry

.github/workflows/audit.yml

@@ -141,7 +141,7 @@ jobs:
           sdk: stable
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
       - name: Install OSV Scanner
         run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@${{ env.OSV_SCANNER_VERSION }}
       - name: Audit Dart templates
@@ -167,7 +167,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: Install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
@@ -247,7 +247,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
       - name: Install OSV Scanner
         run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@${{ env.OSV_SCANNER_VERSION }}
       - name: Audit Maven coordinates in deps.gradle

.github/workflows/build.yml

@@ -183,7 +183,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "1.26.6"
+          go-version: "1.26.9"
           cache: false
       - name: Build templates
         run: for dir in go/*/; do [ ! -f "${dir}go.mod" ] || (cd "$dir" && go build ./...); done

node/email-contact-form/package.json

@@ -12,5 +12,8 @@
   },
   "devDependencies": {
     "prettier": "^3.2.5"
+  },
+  "engines": {
+    "node": ">=20.0.0"
   }
 }

node/generate-pdf/package.json

@@ -13,5 +13,8 @@
   },
   "devDependencies": {
     "prettier": "^3.2.5"
+  },
+  "engines": {
+    "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0"
   }
 }

node/password-expiry/README.md

@@ -45,8 +45,8 @@ You can set CRON to control how often the function is executed. For example, `0
 
 The maximum number of days a password can be used before the user is forced to change it.
 
-| Question      | Answer                |
-| ------------- | --------------------- |
-| Required      | No                    |
-| Default Value | `90`                  |
-| Sample Value  | `https://short.app/s` |
+| Question      | Answer |
+| ------------- | ------ |
+| Required      | No     |
+| Default Value | `90`   |
+| Sample Value  | `90`   |

node/password-expiry/package.json

@@ -15,6 +15,6 @@
     "prettier": "^3.2.5"
   },
   "engines": {
-    "node": ">=18.17.0"
+    "node": ">=20.0.0"
   }
 }

node/password-expiry/src/main.js

@@ -5,7 +5,6 @@ import nodemailer from 'nodemailer';
 export default async ({ req, res, log, error }) => {
   throwIfMissing(process.env, [
     'APPWRITE_FUNCTION_PROJECT_ID',
-    'MAX_PASSWORD_AGE',
     'RESET_PASSWORD_URL',
     'STMP_DSN',
   ]);
@@ -18,13 +17,24 @@ export default async ({ req, res, log, error }) => {
 
   const users = new Users(client);
 
-  const expiryPeriodMs = 1000;
+  const maxPasswordAgeDays = Number(process.env.MAX_PASSWORD_AGE || 90);
+  const expiryPeriodMs = maxPasswordAgeDays * 24 * 60 * 60 * 1000;
   const beforeTimeMs = Date.now() - expiryPeriodMs;
   const beforeDateTime = new Date(beforeTimeMs).toISOString();
 
-  const usersWithExpiredPasswords = await users.list([
-    Query.lessThanEqual('passwordUpdate', beforeDateTime),
-  ]);
+  const usersWithExpiredPasswords = [];
+  let cursor;
+  do {
+    const queries = [
+      Query.lessThanEqual('passwordUpdate', beforeDateTime),
+      Query.limit(100),
+    ];
+    if (cursor) queries.push(Query.cursorAfter(cursor));
+
+    const page = await users.list({ queries, total: false });
+    usersWithExpiredPasswords.push(...page.users);
+    cursor = page.users.length === 100 ? page.users[99].$id : undefined;
+  } while (cursor);
 
   const dsn = new URL(process.env.STMP_DSN);
 
@@ -51,7 +61,7 @@ export default async ({ req, res, log, error }) => {
     try {
       await transport.sendMail({
         from: dsn.searchParams.get('from'),
-        to: 'luke@appwrite.io',
+        to: user.email,
         subject: 'Your password needs to be updated',
         text: `Hi ${
           user.name