fix: bump vulnerable packages

api/package.json

@@ -35,10 +35,12 @@
     "@gram/config": "^4.17.0",
     "@gram/core": "^4.17.0",
     "@sentry/integrations": "^7.6.0",
-    "@sentry/node": "^7.6.0",
+    "@sentry/node": "^8.35.0",
+    "@sentry/profiling-node": "^8.35.0",
     "@sentry/tracing": "^7.6.0",
-    "cookie-parser": "^1.4.6",
-    "express": "^4.19.2",
+    "cookie-parser": "^1.4.7",
+    "core": "file:sentry/profiling-node@latest",
+    "express": "^4.21.1",
     "express-async-error-wrapper": "^1.0.4",
     "express-physical": "^2.0.0",
     "express-prom-bundle": "^6.4.1",

api/src/app.ts

@@ -273,7 +273,7 @@ export async function createApp(dal: DataAccessLayer) {
   }
 
   // Sentry Error Handler
-  app.use(Sentry.Handlers.errorHandler());
+  Sentry.setupExpressErrorHandler(app);
   // Global Error Handler. Should catch anything that propagates up from the REST routes.
   app.use(errorHandler);
 

api/src/controlApp.ts

@@ -26,7 +26,7 @@ export function createControlApp(dal: DataAccessLayer) {
   // Metrics Middleware
   app.use(metricsMiddleware.metricsMiddleware);
   // Sentry Error Handler
-  app.use(Sentry.Handlers.errorHandler());
+  Sentry.setupExpressErrorHandler(app);
   // Global Error Handler. Should catch anything that propagates up from the REST routes.
   app.use(errorHandler);
 

api/src/util/sentry.ts

@@ -1,9 +1,8 @@
-import { RewriteFrames } from "@sentry/integrations";
+import { config } from "@gram/core/dist/config/index.js";
 import * as Sentry from "@sentry/node";
-import * as Tracing from "@sentry/tracing";
+import { nodeProfilingIntegration } from "@sentry/profiling-node";
 import { Express } from "express";
 import log4js from "log4js";
-import { config } from "@gram/core/dist/config/index.js";
 import { version } from "./version.js";
 
 const log = log4js.getLogger("sentry");
@@ -35,15 +34,7 @@ export function initSentry(app: Express) {
     release: `gram@${version}`,
     environment: process.env["NODE_ENV"],
     dsn: sentryDSN as string,
-    integrations: [
-      // Sentry.Integrations.Http is not here due to error when used with c2c proxy :/
-      //
-      // enable Express.js middleware tracing
-      new Tracing.Integrations.Express({ app }),
-      new RewriteFrames({
-        root: global.__rootdir__,
-      }),
-    ],
+    integrations: [nodeProfilingIntegration()],
     // Set tracesSampleRate to 1.0 to capture 100%
     // of transactions for performance monitoring.
     tracesSampleRate: 1.0,
@@ -74,11 +65,5 @@ export function initSentry(app: Express) {
     },
   });
 
-  // RequestHandler creates a separate execution context using domains, so that every
-  // transaction/span/breadcrumb is attached to its own Hub instance
-  app.use(Sentry.Handlers.requestHandler());
-  // TracingHandler creates a trace for every incoming request
-  app.use(Sentry.Handlers.tracingHandler());
-
   log.info("Sentry initialized");
 }

core/package.json

@@ -35,10 +35,11 @@
   },
   "dependencies": {
     "@sentry/integrations": "^7.6.0",
-    "@sentry/node": "^7.6.0",
+    "@sentry/node": "^8.35.0",
+    "@sentry/profiling-node": "^8.35.0",
     "@sentry/tracing": "^7.6.0",
     "emailjs": "^4.0.3",
-    "express": "^4.19.2",
+    "express": "^4.21.1",
     "global-agent": "^3.0.0",
     "handlebars": "^4.7.7",
     "jsonwebtoken": "^9.0.0",