chore: snyk fixes for 2 vulnerabilities

[yashasvibajpai]

Snyk has created this PR to fix 2 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-9292519	703
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	631

---

[!IMPORTANT]

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report 📜 Customise PR templates 🛠 Adjust project settings 📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Server-side Request Forgery (SSRF)

Summary by CodeRabbit

• Chores
  • Upgraded key third-party libraries for improved performance and reliability.
• Refactor
  • Enhanced system profiling functionality to deliver more accurate CPU and memory performance monitoring.
• Tests
  • Updated test coverage to ensure the new profiling features operate robustly and as expected.

[devops-github-rudderstack]

Allure Test reports for this run are available at:

• Allure Report: https://rudderlabs.github.io/rudder-transformer//index.html

[codecov[bot]]

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 91.36%. Comparing base (6612388) to head (0627052). Report is 412 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #4154      +/-   ##
===========================================
+ Coverage    91.11%   91.36%   +0.25%     
===========================================
  Files          630      631       +1     
  Lines        33050    33117      +67     
  Branches      7815     7832      +17     
===========================================
+ Hits         30113    30257     +144     
+ Misses        2730     2622     -108     
- Partials       207      238      +31     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

:rocket: New features to boost your workflow:

• :snowflake: Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• :package: JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[devops-github-rudderstack]

Allure Test reports for this run are available at:

• Allure Report: View Report

[devops-github-rudderstack]

Allure Test reports for this run are available at:

• Allure Report: View Report

[sonarqubecloud[bot]]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[devops-github-rudderstack]

This PR is considered to be stale. It has been open for 20 days with no further activity thus it is going to be closed in 7 days. To avoid such a case please consider removing the stale label manually or add a comment to the PR.

[coderabbitai[bot]]

Walkthrough

This pull request upgrades two dependency versions in the project’s package.json and refactors the profiling functionality in the application. The profiling methods in src/middleware.js have been modified to switch to new start/stop methods for both CPU and heap profiling, replacing the old collection calls. In addition, the tests in src/middleware.test.js have been enhanced to provide detailed mocks and assertions for the updated profiling workflow.

Changes

Files	Change Summary
package.json	Upgraded dependency versions: @pyroscope/nodejs from ^0.2.9 to ^0.3.8 and axios from ^1.7.9 to ^1.8.2.
src/middleware.js, src/middleware.test.js	Refactored profiling functionality: In src/middleware.js, replaced startHeapCollecting with startHeapProfiling, and modified CPU and heap profiling methods to use start/stop methods with Promise and timer logic. In tests, improved mocks and assertions to check the new profiling workflow.

Sequence Diagram(s)

CPU Profiling Flow

sequenceDiagram
    participant Client as User Request
    participant Middleware as getCPUProfile
    participant Timer as setTimeout
    participant Pyroscope

    Client->>Middleware: Call getCPUProfile(seconds)
    Middleware->>Pyroscope: startCpuProfiling()
    Middleware->>Timer: setTimeout(callback, seconds)
    Timer->>Middleware: Trigger callback after seconds
    Middleware->>Pyroscope: stopCpuProfiling()
    Pyroscope-->>Middleware: Return CPU profile
    Middleware-->>Client: Send CPU profile result

Heap Profiling Flow

sequenceDiagram
    participant Client as Caller
    participant Middleware as getHeapProfile
    participant Pyroscope

    Client->>Middleware: Call getHeapProfile()
    Middleware->>Pyroscope: startHeapProfiling()
    Middleware->>Pyroscope: stopHeapProfiling()
    Pyroscope-->>Middleware: Return Heap profile
    Middleware-->>Client: Send Heap profile result

Poem

I'm a bunny in the code delight,
Hopping through changes, day and night.
Dependencies spring with versions new,
Profiling flows now start and stop too.
With tests that bounce and logic so bright,
I cheer each hop to a future more light!
🐇💻

✨ Finishing Touches

• [ ] 📝 Generate Docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai plan to trigger planning for file edits and PR creation.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.