Bump body-parser from 2.2.2 to 2.3.0

Bumps [body-parser](https://github.com/expressjs/body-parser) from 2.2.2 to 2.3.0.
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/body-parser/compare/v2.2.2...v2.3.0)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-version: 2.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile

@@ -1,5 +1,5 @@
 # FROM node:24-slim AS base
-FROM public.ecr.aws/docker/library/node:26-slim AS base
+FROM public.ecr.aws/docker/library/node:24-slim AS base
 
 WORKDIR /app
 
@@ -33,7 +33,7 @@ FROM base AS builder
 RUN npm ci --omit=dev
 
 # FROM node:24-slim AS runner
-FROM public.ecr.aws/docker/library/node:26-slim AS runner
+FROM public.ecr.aws/docker/library/node:24-slim AS runner
 
 WORKDIR /app
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:26-alpine
+FROM node:24-alpine
 
 WORKDIR /app
 

package-lock.json

@@ -9214,20 +9214,20 @@
             }
         },
         "node_modules/body-parser": {
-            "version": "2.2.2",
-            "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
-            "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+            "version": "2.3.0",
+            "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+            "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
             "license": "MIT",
             "dependencies": {
                 "bytes": "^3.1.2",
-                "content-type": "^1.0.5",
+                "content-type": "^2.0.0",
                 "debug": "^4.4.3",
-                "http-errors": "^2.0.0",
-                "iconv-lite": "^0.7.0",
+                "http-errors": "^2.0.1",
+                "iconv-lite": "^0.7.2",
                 "on-finished": "^2.4.1",
-                "qs": "^6.14.1",
-                "raw-body": "^3.0.1",
-                "type-is": "^2.0.1"
+                "qs": "^6.15.2",
+                "raw-body": "^3.0.2",
+                "type-is": "^2.1.0"
             },
             "engines": {
                 "node": ">=18"
@@ -9237,6 +9237,19 @@
                 "url": "https://opencollective.com/express"
             }
         },
+        "node_modules/body-parser/node_modules/content-type": {
+            "version": "2.0.0",
+            "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+            "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+            "license": "MIT",
+            "engines": {
+                "node": ">=18"
+            },
+            "funding": {
+                "type": "opencollective",
+                "url": "https://opencollective.com/express"
+            }
+        },
         "node_modules/body-parser/node_modules/iconv-lite": {
             "version": "0.7.2",
             "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",

server/lib/certificates.ts

@@ -5,7 +5,6 @@ export async function getValidCertificatesForDomains(
     Array<{
         id: number;
         domain: string;
-        queriedDomain: string;
         wildcard: boolean | null;
         certFile: string | null;
         keyFile: string | null;

server/lib/clientVersionChecks.ts

@@ -18,19 +18,3 @@ export function canCompress(
         return false;
     }
 }
-
-// Whether this newt client understands `tlsCertId` references into the
-// sync message's `certs` array, instead of requiring each target to carry
-// its own inline `tlsCert`/`tlsKey` PEM data. Bump the version floor here to
-// match whatever release first ships the newt-side support.
-export function supportsCertReferences(
-    clientVersion: string | null | undefined
-): boolean {
-    try {
-        if (!clientVersion) return false;
-        if (!semver.valid(clientVersion)) return false;
-        return semver.gte(clientVersion, "1.16.0");
-    } catch {
-        return false;
-    }
-}

server/lib/ip.ts

@@ -5,7 +5,6 @@ import config from "@server/lib/config";
 import z from "zod";
 import logger from "@server/logger";
 import semver from "semver";
-import { createHash } from "crypto";
 import { getValidCertificatesForDomains } from "#dynamic/lib/certificates";
 import { lockManager } from "#dynamic/lib/lock";
 
@@ -649,101 +648,21 @@ export type SubnetProxyTargetV2 = {
     httpTargets?: HTTPTarget[];
     tlsCert?: string;
     tlsKey?: string;
-    tlsCertId?: string; // references an entry in the sync message's top-level `certs` array instead of inlining tlsCert/tlsKey
 };
 
-export type CertRef = { id: string; cert: string; key: string };
-
-/**
- * Replaces each target's inline tlsCert/tlsKey with a tlsCertId reference
- * into a deduplicated certs array, so that many targets sharing the same
- * certificate (e.g. a wildcard cert used by thousands of site resources)
- * only need that certificate sent once per sync message.
- */
-export function dedupeCertsForTargets(
-    targetsV2: SubnetProxyTargetV2[]
-): { targets: SubnetProxyTargetV2[]; certs: CertRef[] } {
-    const idByContent = new Map<string, string>();
-    const certs: CertRef[] = [];
-
-    const targets = targetsV2.map((target) => {
-        if (!target.tlsCert || !target.tlsKey) {
-            return target;
-        }
-
-        const contentKey = `${target.tlsCert}|${target.tlsKey}`;
-        let id = idByContent.get(contentKey);
-        if (!id) {
-            id = createHash("sha1").update(contentKey).digest("hex").slice(0, 16);
-            idByContent.set(contentKey, id);
-            certs.push({ id, cert: target.tlsCert, key: target.tlsKey });
-        }
-
-        const { tlsCert, tlsKey, ...rest } = target;
-        return { ...rest, tlsCertId: id };
-    });
-
-    return { targets, certs };
-}
-
 export type HTTPTarget = {
     destAddr: string; // must be an IP or hostname
     destPort: number;
     scheme: "http" | "https";
 };
 
-export type CertByDomain = Map<string, { certFile: string; keyFile: string }>;
-
-/**
- * Fetches the TLS certificates for every enabled, SSL-enabled HTTP site
- * resource's fullDomain in a single batched call, instead of one call per
- * resource. Many resources commonly resolve to the very same certificate
- * (e.g. a wildcard covering the org's domain), so batching turns what would
- * be N concurrent DB/cache round-trips into one, and a lookup failure fails
- * loudly for the whole batch rather than silently dropping the cert on a
- * random subset of otherwise-identical resources under load.
- */
-export async function batchFetchCertsForSiteResources(
-    allSiteResources: SiteResource[]
-): Promise<CertByDomain> {
-    const domains = new Set(
-        allSiteResources
-            .filter((r) => r.enabled && r.mode === "http" && r.ssl && r.fullDomain)
-            .map((r) => r.fullDomain as string)
-    );
-
-    const certByDomain: CertByDomain = new Map();
-    if (domains.size === 0) {
-        return certByDomain;
-    }
-
-    try {
-        const certResults = await getValidCertificatesForDomains(domains, true);
-        for (const cert of certResults) {
-            if (cert.certFile && cert.keyFile) {
-                certByDomain.set(cert.queriedDomain, {
-                    certFile: cert.certFile,
-                    keyFile: cert.keyFile
-                });
-            }
-        }
-    } catch (err) {
-        logger.error(
-            `Failed to batch-retrieve certificates for ${domains.size} domain(s): ${err}`
-        );
-    }
-
-    return certByDomain;
-}
-
 export async function generateSubnetProxyTargetV2(
     siteResource: SiteResource,
     clients: {
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
-    }[],
-    certByDomain?: CertByDomain
+    }[]
 ): Promise<SubnetProxyTargetV2[] | undefined> {
     if (!siteResource.enabled) {
         logger.debug(
@@ -831,40 +750,23 @@ export async function generateSubnetProxyTargetV2(
         let tlsKey: string | undefined;
 
         if (siteResource.ssl && siteResource.fullDomain) {
-            if (certByDomain) {
-                // Caller batch-fetched certs for all resources up front (the
-                // common, high-scale path) — just look up this resource's
-                // domain rather than issuing its own DB/cache round-trip.
-                const cert = certByDomain.get(siteResource.fullDomain);
-                if (cert) {
-                    tlsCert = cert.certFile;
-                    tlsKey = cert.keyFile;
+            try {
+                const certs = await getValidCertificatesForDomains(
+                    new Set([siteResource.fullDomain]),
+                    true
+                );
+                if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
+                    tlsCert = certs[0].certFile;
+                    tlsKey = certs[0].keyFile;
                 } else {
                     logger.warn(
                         `No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
                     );
                 }
-            } else {
-                // No batched map supplied by the caller — fall back to a
-                // single-domain lookup for this resource alone.
-                try {
-                    const certs = await getValidCertificatesForDomains(
-                        new Set([siteResource.fullDomain]),
-                        true
-                    );
-                    if (certs.length > 0 && certs[0].certFile && certs[0].keyFile) {
-                        tlsCert = certs[0].certFile;
-                        tlsKey = certs[0].keyFile;
-                    } else {
-                        logger.warn(
-                            `No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
-                        );
-                    }
-                } catch (err) {
-                    logger.error(
-                        `Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
-                    );
-                }
+            } catch (err) {
+                logger.error(
+                    `Failed to retrieve certificate for site resource ${siteResource.siteResourceId} domain ${siteResource.fullDomain}: ${err}`
+                );
             }
         }
 

server/routers/newt/buildConfiguration.ts

@@ -19,7 +19,6 @@ import { eq, and, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import {
-    batchFetchCertsForSiteResources,
     formatEndpoint,
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
@@ -207,18 +206,11 @@ export async function buildClientConfigurationForNewtClient(
         });
     }
 
-    // Batch-fetch certs for every SSL-enabled HTTP resource's domain in one
-    // call rather than letting each resource fetch its own — with thousands
-    // of resources this avoids a concurrent DB/cache stampede for what is
-    // often the very same (e.g. wildcard) certificate.
-    const certByDomain = await batchFetchCertsForSiteResources(allSiteResources);
-
     const resourceTargetsArr = await Promise.all(
         allSiteResources.map((resource) =>
             generateSubnetProxyTargetV2(
                 resource,
-                clientsByResourceId.get(resource.siteResourceId) ?? [],
-                certByDomain
+                clientsByResourceId.get(resource.siteResourceId) ?? []
             )
         )
     );

server/routers/newt/certs.ts

@@ -1,75 +0,0 @@
-import { sendToClient } from "#dynamic/routers/ws";
-import logger from "@server/logger";
-import {
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { CertRef } from "@server/lib/ip";
-
-/**
- * Pushes an incremental set of certs to a newt client outside of a full
- * newt/sync or newt/wg/receive-config, e.g. after a certificate renewal so
- * that every target referencing it (by tlsCertId) picks up the new material
- * without waiting for the next full resync.
- */
-export async function sendCertsAdd(
-    newtId: string,
-    certs: CertRef[],
-    version?: string | null
-) {
-    if (certs.length === 0) {
-        return;
-    }
-
-    if (!supportsCertReferences(version)) {
-        logger.debug(
-            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/add`
-        );
-        return;
-    }
-
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/certs/add",
-            data: certs
-        },
-        {
-            incrementConfigVersion: true,
-            compress: canCompress(version, "newt")
-        }
-    );
-}
-
-/**
- * Tells a newt client to drop the given cert IDs, e.g. once the server knows
- * no target references them anymore.
- */
-export async function sendCertsRemove(
-    newtId: string,
-    certIds: string[],
-    version?: string | null
-) {
-    if (certIds.length === 0) {
-        return;
-    }
-
-    if (!supportsCertReferences(version)) {
-        logger.debug(
-            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/remove`
-        );
-        return;
-    }
-
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/certs/remove",
-            data: { ids: certIds }
-        },
-        {
-            incrementConfigVersion: true,
-            compress: canCompress(version, "newt")
-        }
-    );
-}

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -7,11 +7,7 @@ import { eq } from "drizzle-orm";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
 import { convertTargetsIfNecessary } from "../client/targets";
-import {
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { dedupeCertsForTargets } from "@server/lib/ip";
+import { canCompress } from "@server/lib/clientVersionChecks";
 import config from "@server/lib/config";
 import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
 
@@ -123,16 +119,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         exitNode
     );
 
-    // Older newt clients only understand inline tlsCert/tlsKey on each
-    // target, so only switch to certId references once we know the client
-    // can resolve them.
-    let dedupedTargets = targets;
-    let certs: { id: string; cert: string; key: string }[] = [];
-    if (supportsCertReferences(newt.version)) {
-        ({ targets: dedupedTargets, certs } = dedupeCertsForTargets(targets));
-    }
-
-    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, dedupedTargets); // for backward compatibility with old newt versions that don't support the new target format
+    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
 
     return {
         message: {
@@ -141,7 +128,6 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
                 ipAddress: site.address,
                 peers,
                 targets: targetsToSend,
-                certs,
                 chainId: chainId
             }
         },

server/routers/newt/sync.ts

@@ -6,11 +6,7 @@ import {
     buildClientConfigurationForNewtClient,
     buildTargetConfigurationForNewtClient
 } from "./buildConfiguration";
-import {
-    canCompress,
-    supportsCertReferences
-} from "@server/lib/clientVersionChecks";
-import { dedupeCertsForTargets } from "@server/lib/ip";
+import { canCompress } from "@server/lib/clientVersionChecks";
 
 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
     const {
@@ -32,16 +28,6 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
         site,
         exitNode
     );
-
-    // Older newt clients only understand inline tlsCert/tlsKey on each
-    // target, so only switch to certId references once we know the client
-    // can resolve them.
-    let clientTargets = targets;
-    let certs: { id: string; cert: string; key: string }[] = [];
-    if (supportsCertReferences(newt.version)) {
-        ({ targets: clientTargets, certs } = dedupeCertsForTargets(targets));
-    }
-
     await sendToClient(
         newt.newtId,
         {
@@ -53,8 +39,7 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 },
                 healthCheckTargets: validHealthCheckTargets,
                 peers: peers,
-                clientTargets: clientTargets,
-                certs: certs,
+                clientTargets: targets,
                 browserGatewayTargets: browserGatewayTargets,
                 remoteExitNodeSubnets: remoteExitNodeSubnets
             }

src/hooks/useOptimisticLabels.ts

@@ -95,10 +95,7 @@ export function useOptimisticLabels({
     }
 
     async function refresh() {
-        // Only refresh if the labels have been modified
-        if (pendingActions.length > 0) {
-            router.refresh();
-        }
+        router.refresh();
         setPendingActions([]);
     }