chore: upgrade to Chatwoot v4.18.0

.bundler-audit.yml

@@ -2,8 +2,30 @@
 ignore:
   - CVE-2021-41098 # https://github.com/chatwoot/chatwoot/issues/3097 (update once azure blob storage is updated)
   - GHSA-57hq-95w6-v4fc # Devise confirmable race condition — patched locally in User model (remove once on Devise 5+)
-  # Chatwoot defaults to Active Storage redirect-style URLs, and its recommended
-  # storage setup uses local/cloud storage with optional direct uploads to the
-  # storage provider rather than Rails proxy mode. Revisit if we enable
-  # rails_storage_proxy or other app-served Active Storage proxy routes.
+  # Devise 5 is currently blocked by devise-secure_password/devise_token_auth/devise-two-factor.
+  # Chatwoot does not enable Timeoutable, so the timeout redirect path is not reachable.
+  - GHSA-jp94-3292-c3xv
+  # Rails 7.1 has no patched release for the Active Storage proxy range
+  # advisories. Chatwoot limits proxy range requests locally.
   - CVE-2026-33658
+  # Rails 7.1 has no patched release for this Active Storage direct-upload
+  # advisory. Chatwoot filters internal metadata keys locally.
+  - CVE-2026-33173
+  - CVE-2026-33174
+  # Rails 7.1 has no patched release for these Rails advisories. These are not
+  # reachable through Chatwoot's current usage patterns and should be removed
+  # once we upgrade to Rails 7.2.3.1+.
+  - CVE-2026-33168
+  - CVE-2026-33169
+  - CVE-2026-33170
+  - CVE-2026-33176
+  - CVE-2026-33195
+  - CVE-2026-33202
+  # No Rails 7.1 patch for this Active Storage advisory; mitigated locally.
+  # Remove once on Rails 7.2.3.1+.
+  - CVE-2026-66066
+  # RubyLLM's name-normalization ReDoS is reported on Ruby 3.1; we require Ruby 3.4.4.
+  # Built-in tool names are fixed; custom tools use bounded slugs and override normalization.
+  # Patched 2.0 releases need an ai-agents migration (currently constrained to RubyLLM 1.x).
+  # Remove when a supported patched RubyLLM/ai-agents combination is adopted.
+  - CVE-2026-67991

.circleci/config.yml

@@ -77,7 +77,8 @@ jobs:
 
       - node/install:
           node-version: '24.13'
-      - node/install-pnpm
+      - node/install-pnpm:
+          version: '10.2.0'
       - node/install-packages:
           pkg-manager: pnpm
           override-ci-command: pnpm i
@@ -118,7 +119,8 @@ jobs:
       - checkout
       - node/install:
           node-version: '24.13'
-      - node/install-pnpm
+      - node/install-pnpm:
+          version: '10.2.0'
       - node/install-packages:
           pkg-manager: pnpm
           override-ci-command: pnpm i
@@ -149,7 +151,8 @@ jobs:
       - checkout
       - node/install:
           node-version: '24.13'
-      - node/install-pnpm
+      - node/install-pnpm:
+          version: '10.2.0'
       - node/install-packages:
           pkg-manager: pnpm
           override-ci-command: pnpm i

.env.example

@@ -59,6 +59,16 @@ REDIS_SENTINEL_MASTER_NAME=
 # ref: https://github.com/chatwoot/chatwoot/issues/2420
 # REDIS_OPENSSL_VERIFY_MODE=none
 
+# OpenSearch / Elasticsearch-compatible search config
+# Set OPENSEARCH_URL to enable advanced search. Elastic Cloud API keys can be configured with either key name below.
+# API key values must be provided without the ApiKey authorization scheme prefix.
+# OPENSEARCH_URL=
+# OPENSEARCH_API_KEY=
+# ELASTICSEARCH_API_KEY=
+# OPENSEARCH_AWS_ACCESS_KEY_ID=
+# OPENSEARCH_AWS_SECRET_ACCESS_KEY=
+# OPENSEARCH_AWS_REGION=us-east-1
+
 # Postgres Database config variables
 # You can leave POSTGRES_DATABASE blank. The default name of
 # the database in the production environment is chatwoot_production
@@ -98,6 +108,8 @@ SMTP_OPENSSL_VERIFY_MODE=peer
 # Mail Incoming
 # This is the domain set for the reply emails when conversation continuity is enabled
 MAILER_INBOUND_EMAIL_DOMAIN=
+# Maximum time in seconds to process a single IMAP email
+# EMAIL_PROCESSING_TIMEOUT_SECONDS=60
 # Set this to the appropriate ingress channel with regards to incoming emails
 # Possible values are :
 # relay for Exim, Postfix, Qmail
@@ -130,6 +142,11 @@ ACTION_MAILBOX_SES_SNS_TOPIC=
 # Storage
 ACTIVE_STORAGE_SERVICE=local
 
+# Restrict libvips to its trusted, well-tested image loaders when Active Storage
+# generates variants. Hardens image processing against untrusted uploads.
+# Requires libvips >= 8.13 (ignored on older versions).
+VIPS_BLOCK_UNTRUSTED=1
+
 # Amazon S3
 # documentation: https://www.chatwoot.com/docs/configuring-s3-bucket-as-cloud-storage
 S3_BUCKET_NAME=
@@ -149,6 +166,8 @@ LOG_SIZE=500
 
 # Facebook
 # documentation: https://www.chatwoot.com/docs/facebook-setup
+# Connected Facebook pages are subscribed by Chatwoot to Messenger webhook
+# fields, including postbacks used by Get Started and button flows.
 FB_VERIFY_TOKEN=
 FB_APP_SECRET=
 FB_APP_ID=
@@ -166,6 +185,7 @@ TWITTER_ENVIRONMENT=
 #slack integration
 SLACK_CLIENT_ID=
 SLACK_CLIENT_SECRET=
+SLACK_SIGNING_SECRET=
 
 # Google OAuth
 GOOGLE_OAUTH_CLIENT_ID=
@@ -228,10 +248,30 @@ ANDROID_SHA256_CERT_FINGERPRINT=AC:73:8E:DE:EB:56:EA:CC:10:87:02:A7:65:37:7B:38:
 ## To prevent and throttle abusive requests
 # ENABLE_RACK_ATTACK=true
 # RACK_ATTACK_LIMIT=300
+## Parent switch for all widget throttles; per-endpoint switches below only apply when this is on
 # ENABLE_RACK_ATTACK_WIDGET_API=true
+## Widget conversation creates, per minute, keyed on (IP, website_token)
+# ENABLE_RACK_ATTACK_WIDGET_CONVERSATIONS=true
+# RATE_LIMIT_WIDGET_CONVERSATIONS=30
+## Widget message creates, per minute, keyed on (IP, website_token)
+# ENABLE_RACK_ATTACK_WIDGET_MESSAGES=true
+# RATE_LIMIT_WIDGET_MESSAGES=60
+## Widget contact updates, per hour, per IP
+# ENABLE_RACK_ATTACK_WIDGET_CONTACTS=true
+# RATE_LIMIT_WIDGET_CONTACTS=60
+## Widget page loads (new session), per hour, per IP
+# ENABLE_RACK_ATTACK_WIDGET_LOAD=true
+# RATE_LIMIT_WIDGET_LOAD=200
+## Widget transcript requests, per hour, per IP
+# ENABLE_RACK_ATTACK_WIDGET_TRANSCRIPT=true
+# RATE_LIMIT_WIDGET_TRANSCRIPT=5
 # Comma-separated list of trusted IPs that bypass Rack Attack throttling rules
 # RACK_ATTACK_ALLOWED_IPS=127.0.0.1,::1,192.168.0.10
 
+## SafeFetch private network access
+## Keep disabled by default. Self-hosted installations can enable this to allow SafeFetch requests to private network URLs.
+# SAFE_FETCH_ALLOW_PRIVATE_NETWORK=false
+
 ## Running chatwoot as an API only server
 ## setting this value to true will disable the frontend dashboard endpoints
 # CW_API_ONLY_SERVER=false
@@ -266,9 +306,9 @@ AZURE_APP_SECRET=
 # ENABLE_SIDEKIQ_DEQUEUE_LOGGER=false
 
 
-# AI powered features
-## OpenAI key
-# OPENAI_API_KEY=
+# AI powered features (Captain)
+# The OpenAI API key and endpoint for Captain are not configured via .env.
+# Set them at Super Admin > App Configs > Captain (CAPTAIN_OPEN_AI_API_KEY, CAPTAIN_OPEN_AI_ENDPOINT).
 
 # Housekeeping/Performance related configurations
 # Set to true if you want to remove stale contact inboxes
@@ -277,3 +317,15 @@ AZURE_APP_SECRET=
 
 # REDIS_ALFRED_SIZE=10
 # REDIS_VELMA_SIZE=10
+
+# Publish Sidekiq queue metrics to AWS CloudWatch for autoscaling. Off by default.
+# By default uses the instance role, which must allow cloudwatch:PutMetricData.
+# ENABLE_SIDEKIQ_CLOUDWATCH=true
+# SIDEKIQ_CLOUDWATCH_NAMESPACE=Chatwoot/Sidekiq
+# Publish interval in seconds (default 60; values below 60 work but bill as high-resolution CloudWatch metrics)
+# SIDEKIQ_CLOUDWATCH_INTERVAL=60
+# Optional: dedicated credentials for CloudWatch only, separate from the S3 (storage) keys.
+# Set these to override the instance role when a role is not available.
+# SIDEKIQ_CLOUDWATCH_AWS_ACCESS_KEY_ID=
+# SIDEKIQ_CLOUDWATCH_AWS_SECRET_ACCESS_KEY=
+# SIDEKIQ_CLOUDWATCH_AWS_REGION=us-east-1

.eslintrc.js

@@ -247,6 +247,7 @@ module.exports = {
   },
   env: {
     browser: true,
+    es2020: true,
     node: true,
   },
   globals: {

.github/scripts/ghsa_linear_sync.py

@@ -0,0 +1,195 @@
+#!/usr/bin/env python3
+"""Sync triage GitHub security advisories to Linear issues."""
+
+from __future__ import annotations
+
+import os
+import sys
+from typing import Any
+
+import requests
+
+GITHUB_API = "https://api.github.com"
+LINEAR_API = "https://api.linear.app/graphql"
+
+SEVERITY_PRIORITY = {"critical": 1, "high": 2, "medium": 3, "low": 4}
+SEVERITY_COLOR = {
+    "critical": 15548997,
+    "high": 15105570,
+    "medium": 15844367,
+    "low": 3066993,
+}
+DEFAULT_COLOR = 9807270
+
+
+def required_env(name: str) -> str:
+    value = os.environ.get(name)
+    if not value:
+        sys.exit(f"Missing required env var: {name}")
+    return value
+
+
+def fetch_triage_advisories(repo: str, token: str) -> list[dict[str, Any]]:
+    url: str | None = f"{GITHUB_API}/repos/{repo}/security-advisories"
+    params: dict[str, Any] | None = {"state": "triage", "per_page": 100}
+    headers = {
+        "Accept": "application/vnd.github+json",
+        "Authorization": f"Bearer {token}",
+        "X-GitHub-Api-Version": "2022-11-28",
+    }
+    advisories: list[dict[str, Any]] = []
+    while url:
+        r = requests.get(url, headers=headers, params=params, timeout=30)
+        r.raise_for_status()
+        advisories.extend(r.json())
+        next_link = r.links.get("next")
+        url = next_link["url"] if next_link else None
+        params = None
+    return advisories
+
+
+def linear_call(query: str, variables: dict[str, Any], api_key: str) -> dict[str, Any]:
+    r = requests.post(
+        LINEAR_API,
+        headers={"Authorization": api_key},
+        json={"query": query, "variables": variables},
+        timeout=30,
+    )
+    r.raise_for_status()
+    return r.json()
+
+
+def linear_issue_exists(ghsa_id: str, api_key: str) -> bool:
+    query = (
+        "query($q: String!) { issues(filter: {title: {contains: $q}}, first: 1) "
+        "{ nodes { id } } }"
+    )
+    resp = linear_call(query, {"q": ghsa_id}, api_key)
+    return len(resp.get("data", {}).get("issues", {}).get("nodes", [])) > 0
+
+
+def linear_create_issue(input_data: dict[str, Any], api_key: str) -> dict[str, str] | None:
+    query = (
+        "mutation($input: IssueCreateInput!) { issueCreate(input: $input) "
+        "{ success issue { identifier url } } }"
+    )
+    resp = linear_call(query, {"input": input_data}, api_key)
+    create = resp.get("data", {}).get("issueCreate") or {}
+    if not create.get("success"):
+        return None
+    return create.get("issue")
+
+
+def reporter_login(advisory: dict[str, Any]) -> str:
+    for credit in advisory.get("credits") or []:
+        user = (credit or {}).get("user") or {}
+        if user.get("login"):
+            return user["login"]
+    return "unknown"
+
+
+def cvss_score(advisory: dict[str, Any]) -> str:
+    score = (advisory.get("cvss") or {}).get("score")
+    return str(score) if score is not None else "n/a"
+
+
+def build_description(adv: dict[str, Any]) -> str:
+    return (
+        f"**GHSA:** {adv['ghsa_id']}\n"
+        f"**CVE:** {adv.get('cve_id') or 'n/a'}\n"
+        f"**Severity:** {adv.get('severity') or 'unknown'} (CVSS {cvss_score(adv)})\n"
+        f"**Reporter:** {reporter_login(adv)}\n"
+        f"**Reported:** {(adv.get('created_at') or '').split('T')[0]}\n"
+        f"**Advisory:** {adv['html_url']}\n\n"
+        f"---\n\n"
+        f"{adv.get('description') or 'No description provided.'}"
+    )
+
+
+def post_discord(adv: dict[str, Any], issue: dict[str, str], webhook_url: str) -> None:
+    severity = adv.get("severity") or "unknown"
+    title = f"[{adv['ghsa_id']}] {adv['summary']}"[:250]
+    payload = {
+        "username": "GHSA Sync",
+        "embeds": [
+            {
+                "title": title,
+                "url": issue["url"],
+                "color": SEVERITY_COLOR.get(severity, DEFAULT_COLOR),
+                "fields": [
+                    {"name": "Linear", "value": issue["identifier"], "inline": True},
+                    {
+                        "name": "Severity",
+                        "value": f"{severity} (CVSS {cvss_score(adv)})",
+                        "inline": True,
+                    },
+                    {
+                        "name": "Advisory",
+                        "value": f"[GitHub]({adv['html_url']})",
+                        "inline": True,
+                    },
+                ],
+            }
+        ],
+    }
+    try:
+        requests.post(webhook_url, json=payload, timeout=10)
+    except requests.RequestException:
+        pass
+
+
+def main() -> int:
+    repo = required_env("GITHUB_REPOSITORY")
+    gh_token = required_env("GHSA_READ_TOKEN")
+    linear_api_key = required_env("LINEAR_API_KEY")
+    team_id = required_env("LINEAR_TEAM_ID")
+    project_id = required_env("LINEAR_PROJECT_ID")
+    label_id = required_env("LINEAR_LABEL_ID")
+    discord_webhook = os.environ.get("DISCORD_WEBHOOK_URL") or None
+
+    advisories = fetch_triage_advisories(repo, gh_token)
+    print(f"Fetched {len(advisories)} triage advisories")
+
+    created = skipped = failed = 0
+
+    for adv in advisories:
+        ghsa_id = adv.get("ghsa_id")
+        if not ghsa_id:
+            failed += 1
+            continue
+
+        try:
+            if linear_issue_exists(ghsa_id, linear_api_key):
+                skipped += 1
+                continue
+
+            severity = adv.get("severity") or "unknown"
+            issue = linear_create_issue(
+                {
+                    "title": f"[{ghsa_id}] {adv.get('summary', '')}",
+                    "description": build_description(adv),
+                    "teamId": team_id,
+                    "projectId": project_id,
+                    "labelIds": [label_id],
+                    "priority": SEVERITY_PRIORITY.get(severity, 3),
+                },
+                linear_api_key,
+            )
+        except requests.RequestException:
+            failed += 1
+            continue
+
+        if not issue:
+            failed += 1
+            continue
+
+        created += 1
+        if discord_webhook:
+            post_discord(adv, issue, discord_webhook)
+
+    print(f"Created {created}, skipped {skipped}, failed {failed}")
+    return 1 if failed > 0 else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

.github/workflows/deploy_check.yml

@@ -11,6 +11,9 @@ concurrency:
   group: pr-${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   deployment_check:
     name: Check Deployment