Skip to content

chore(deps): @profullstack/throttle 0.3.4 (subresources get their own bucket) - #297

Merged
ralyodio merged 1 commit into
masterfrom
chore/throttle-0.3.4
Oct 23, 2026
Merged

ralyodio merged 1 commit into
masterfrom
chore/throttle-0.3.4

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Moves @profullstack/throttle to 0.3.4.

0.3.4 gives images/fonts/scripts/styles (by Sec-Fetch-Dest) their own 1000/min bucket, so a page full of images can no longer burn the 100/min page allowance and 402 a real person (seen on saasrow /admin).

Lockfile-only change: the spec stays ^0.3.3, the lockfile now resolves 0.3.4.

🤖 Generated with Claude Code

… bucket)

0.3.4 gives images, fonts, scripts and styles (Sec-Fetch-Dest) their own
1000/min bucket, so a page full of images can no longer burn the 100/min
page allowance and 402 a real person.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updated@​profullstack/​throttle@​0.3.3 ⏵ 0.3.478 +1100100 +195 +1100

View full report

@ralyodio
ralyodio merged commit 3044472 into master Oct 23, 2026
7 checks passed
@ralyodio
ralyodio deleted the chore/throttle-0.3.4 branch October 23, 2026 03:06
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

97 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 30 | LOW: 56

Severity Rule Location
HIGH secret-private-key src/app/settings/seedbox-section.tsx:412
HIGH secret-generic-api-key docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH tls-verification-disabled src/app/api/iptv-proxy/route.ts:39
HIGH tls-verification-disabled src/app/api/iptv/channels/route.ts:35
HIGH tls-verification-disabled src/app/api/iptv/playlists/[id]/route.ts:73
HIGH tls-verification-disabled src/app/api/iptv/playlists/route.ts:64
HIGH js-cors-origin-reflected src/app/api/public/shares/[slug]/checkout/route.ts:40
HIGH js-cors-origin-reflected src/app/api/public/vod/[slug]/checkout/route.ts:34
HIGH tls-verification-disabled src/lib/iptv/shares/upstream.ts:37
HIGH tls-verification-disabled workers/iptv-cache/epg-fetcher.ts:25
HIGH tls-verification-disabled workers/iptv-cache/playlist-fetcher.ts:62
MEDIUM secret-jwt .github/workflows/ci.yml:120
MEDIUM secret-jwt .github/workflows/ci.yml:121
MEDIUM secret-jwt .github/workflows/ci.yml:123
MEDIUM secret-jwt .github/workflows/ci.yml:162
MEDIUM secret-jwt .github/workflows/ci.yml:164
MEDIUM secret-jwt docs/tunein (2).py:9
MEDIUM secret-jwt docs/tunein.py:9
MEDIUM sh-remote-script-execution scripts/setup-server.sh:182
MEDIUM sh-remote-script-execution scripts/setup-server.sh:419
MEDIUM sh-remote-script-execution scripts/setup-server.sh:428
MEDIUM sh-unquoted-expansion-destructive scripts/setup-server.sh:1096
MEDIUM sh-unquoted-expansion-destructive scripts/setup-server.sh:1106
MEDIUM js-unescaped-html-sink src/app/api/player/route.ts:127
MEDIUM js-unescaped-html-sink src/app/api/player/route.ts:281
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.tsx:40
MEDIUM js-unescaped-html-sink src/app/blog/[slug]/page.tsx:66
MEDIUM js-unescaped-html-sink src/app/email/email-content.tsx:566
MEDIUM js-open-redirect src/app/login/page.tsx:68
MEDIUM js-open-redirect src/app/pricing/page.tsx:148
MEDIUM js-open-redirect src/app/rent/[slug]/rent-client.tsx:170
MEDIUM js-unescaped-html-sink src/app/rss/rss-content.tsx:615
MEDIUM js-open-redirect src/app/vod/[slug]/vod-client.tsx:138
MEDIUM js-open-redirect src/app/watch/[slug]/watch-client.tsx:131
MEDIUM js-unescaped-html-sink src/app/youtube/youtube-content.tsx:546
MEDIUM js-open-redirect src/components/account/iptv-subscription-section.tsx:121
MEDIUM js-open-redirect src/components/account/iptv-subscription-section.tsx:151
MEDIUM js-unescaped-html-sink src/components/layout/pit-footer.tsx:25
MEDIUM js-unescaped-html-sink src/components/news/news-section.tsx:358
MEDIUM js-unescaped-html-sink src/components/news/news-section.tsx:731
MEDIUM redos-nested-quantifier src/lib/metadata-enrichment/metadata-enrichment.ts:317
LOW tls-verification-disabled docs/tunein (2).py:34
LOW tls-verification-disabled docs/tunein (2).py:37
LOW tls-verification-disabled docs/tunein (2).py:47
LOW tls-verification-disabled docs/tunein.py:34
LOW tls-verification-disabled docs/tunein.py:37
LOW tls-verification-disabled docs/tunein.py:47
LOW tls-verification-disabled src/app/api/iptv-proxy/route.test.ts:457
LOW secret-generic-credential src/app/api/iptv/subscription/route.test.ts:66
LOW secret-generic-credential src/lib/argontv/client.test.ts:54

…and 47 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant