add email consent and update audience

Bump the dev-minor-updates group across 1 directory with 3 updates

.github/workflows/cicd.yml

@@ -39,7 +39,7 @@ jobs:
               uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
             - name: Set up QEMU
-              uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
+              uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

install/go.mod

@@ -3,8 +3,8 @@ module installer
 go 1.24.0
 
 require (
-	golang.org/x/term v0.36.0
+	golang.org/x/term v0.37.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
-require golang.org/x/sys v0.37.0 // indirect
+require golang.org/x/sys v0.38.0 // indirect

install/go.sum

@@ -1,7 +1,7 @@
-golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
-golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
-golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

install/main.go

@@ -238,7 +238,6 @@ func main() {
 				}
 
 				fmt.Println("CrowdSec installed successfully!")
-				return
 			}
 		}
 	}

messages/en-US.json

@@ -1421,6 +1421,9 @@
         "and": "and",
         "privacyPolicy": "privacy policy"
     },
+    "signUpMarketing": {
+        "keepMeInTheLoop": "Keep me in the loop with news, updates, and new features by email."
+    },
     "siteRequired": "Site is required.",
     "olmTunnel": "Olm Tunnel",
     "olmTunnelDescription": "Use Olm for client connectivity",

package.json

@@ -39,20 +39,20 @@
         "@node-rs/argon2": "^2.0.2",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
-        "@radix-ui/react-avatar": "1.1.10",
+        "@radix-ui/react-avatar": "1.1.11",
         "@radix-ui/react-checkbox": "1.3.3",
         "@radix-ui/react-collapsible": "1.1.12",
         "@radix-ui/react-dialog": "1.1.15",
         "@radix-ui/react-dropdown-menu": "2.1.16",
         "@radix-ui/react-icons": "1.3.2",
-        "@radix-ui/react-label": "2.1.7",
+        "@radix-ui/react-label": "2.1.8",
         "@radix-ui/react-popover": "1.1.15",
-        "@radix-ui/react-progress": "^1.1.7",
+        "@radix-ui/react-progress": "^1.1.8",
         "@radix-ui/react-radio-group": "1.3.8",
         "@radix-ui/react-scroll-area": "^1.2.10",
         "@radix-ui/react-select": "2.2.6",
-        "@radix-ui/react-separator": "1.1.7",
-        "@radix-ui/react-slot": "1.2.3",
+        "@radix-ui/react-separator": "1.1.8",
+        "@radix-ui/react-slot": "1.2.4",
         "@radix-ui/react-switch": "1.2.6",
         "@radix-ui/react-tabs": "1.1.13",
         "@radix-ui/react-toast": "1.2.15",
@@ -65,7 +65,7 @@
         "@tailwindcss/forms": "^0.5.10",
         "@tanstack/react-table": "8.21.3",
         "arctic": "^3.7.0",
-        "axios": "^1.13.1",
+        "axios": "^1.13.2",
         "better-sqlite3": "11.7.0",
         "canvas-confetti": "1.9.4",
         "class-variance-authority": "^0.7.1",
@@ -78,8 +78,8 @@
         "crypto-js": "^4.2.0",
         "date-fns": "4.1.0",
         "drizzle-orm": "0.44.7",
-        "eslint": "9.39.0",
-        "eslint-config-next": "16.0.1",
+        "eslint": "9.39.1",
+        "eslint-config-next": "16.0.3",
         "express": "5.1.0",
         "express-rate-limit": "8.2.1",
         "glob": "11.0.3",
@@ -89,10 +89,10 @@
         "input-otp": "1.4.2",
         "ioredis": "5.8.2",
         "jmespath": "^0.16.0",
-        "js-yaml": "4.1.0",
+        "js-yaml": "4.1.1",
         "jsonwebtoken": "^9.0.2",
         "lucide-react": "^0.552.0",
-        "maxmind": "5.0.0",
+        "maxmind": "5.0.1",
         "moment": "2.30.1",
         "next": "15.5.6",
         "next-intl": "^4.4.0",
@@ -105,7 +105,7 @@
         "nprogress": "^0.2.0",
         "oslo": "1.2.1",
         "pg": "^8.16.2",
-        "posthog-node": "^5.11.0",
+        "posthog-node": "^5.11.2",
         "qrcode.react": "4.2.0",
         "react": "19.2.0",
         "react-day-picker": "9.11.1",
@@ -115,7 +115,7 @@
         "react-icons": "^5.5.0",
         "rebuild": "0.1.2",
         "reodotdev": "^1.0.0",
-        "resend": "^6.4.0",
+        "resend": "^6.4.2",
         "semver": "^7.7.3",
         "stripe": "18.2.1",
         "swagger-ui-express": "^5.0.1",
@@ -147,7 +147,7 @@
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "^9.0.10",
         "@types/nprogress": "^0.2.3",
-        "@types/node": "24.9.2",
+        "@types/node": "24.10.1",
         "@types/nodemailer": "7.0.3",
         "@types/pg": "8.15.6",
         "@types/react": "19.2.2",
@@ -157,8 +157,8 @@
         "@types/ws": "8.18.1",
         "@types/yargs": "17.0.34",
         "drizzle-kit": "0.31.6",
-        "esbuild": "0.25.12",
-        "esbuild-node-externals": "1.18.0",
+        "esbuild": "0.27.0",
+        "esbuild-node-externals": "1.19.1",
         "postcss": "^8",
         "react-email": "4.3.2",
         "tailwindcss": "^4.1.4",

server/apiServer.ts

@@ -79,6 +79,12 @@ export function createApiServer() {
     // Add request timeout middleware
     apiServer.use(requestTimeoutMiddleware(60000)); // 60 second timeout
 
+    apiServer.use(logIncomingMiddleware);
+
+    if (build !== "oss") {
+        apiServer.use(`${prefix}/hybrid`, hybridRouter); // put before rate limiting because we will rate limit there separately because some of the routes are heavily used
+    }
+
     if (!dev) {
         apiServer.use(
             rateLimit({
@@ -101,11 +107,7 @@ export function createApiServer() {
     }
 
     // API routes
-    apiServer.use(logIncomingMiddleware);
     apiServer.use(prefix, unauthenticated);
-    if (build !== "oss") {
-        apiServer.use(`${prefix}/hybrid`, hybridRouter);
-    }
     apiServer.use(prefix, authenticated);
 
     // WebSocket routes

server/private/lib/rateLimit.ts

@@ -72,6 +72,43 @@ export class RateLimitService {
         return `ratelimit:${clientId}:${messageType}`;
     }
 
+    // Helper function to clean up old timestamp fields from a Redis hash
+    private async cleanupOldTimestamps(key: string, windowStart: number): Promise<void> {
+        if (!redisManager.isRedisEnabled()) return;
+
+        try {
+            const client = redisManager.getClient();
+            if (!client) return;
+
+            // Get all fields in the hash
+            const allData = await redisManager.hgetall(key);
+            if (!allData || Object.keys(allData).length === 0) return;
+
+            // Find fields that are older than the window
+            const fieldsToDelete: string[] = [];
+            for (const timestamp of Object.keys(allData)) {
+                const time = parseInt(timestamp);
+                if (time < windowStart) {
+                    fieldsToDelete.push(timestamp);
+                }
+            }
+
+            // Delete old fields in batches to avoid call stack size exceeded errors
+            // The spread operator can cause issues with very large arrays
+            if (fieldsToDelete.length > 0) {
+                const batchSize = 1000; // Process 1000 fields at a time
+                for (let i = 0; i < fieldsToDelete.length; i += batchSize) {
+                    const batch = fieldsToDelete.slice(i, i + batchSize);
+                    await client.hdel(key, ...batch);
+                }
+                logger.debug(`Cleaned up ${fieldsToDelete.length} old timestamp fields from ${key}`);
+            }
+        } catch (error) {
+            logger.error(`Failed to cleanup old timestamps for key ${key}:`, error);
+            // Don't throw - cleanup failures shouldn't block rate limiting
+        }
+    }
+
     // Helper function to sync local rate limit data to Redis
     private async syncRateLimitToRedis(
         clientId: string,
@@ -81,8 +118,12 @@ export class RateLimitService {
 
         try {
             const currentTime = Math.floor(Date.now() / 1000);
+            const windowStart = currentTime - RATE_LIMIT_WINDOW;
             const globalKey = this.getRateLimitKey(clientId);
 
+            // Clean up old timestamp fields before writing
+            await this.cleanupOldTimestamps(globalKey, windowStart);
+
             // Get current value and add pending count
             const currentValue = await redisManager.hget(
                 globalKey,
@@ -93,7 +134,7 @@ export class RateLimitService {
             ).toString();
             await redisManager.hset(globalKey, currentTime.toString(), newValue);
 
-            // Set TTL using the client directly
+            // Set TTL using the client directly - this prevents the key from persisting forever
             if (redisManager.getClient()) {
                 await redisManager
                     .getClient()
@@ -119,8 +160,12 @@ export class RateLimitService {
 
         try {
             const currentTime = Math.floor(Date.now() / 1000);
+            const windowStart = currentTime - RATE_LIMIT_WINDOW;
             const messageTypeKey = this.getMessageTypeRateLimitKey(clientId, messageType);
 
+            // Clean up old timestamp fields before writing
+            await this.cleanupOldTimestamps(messageTypeKey, windowStart);
+
             // Get current value and add pending count
             const currentValue = await redisManager.hget(
                 messageTypeKey,
@@ -135,7 +180,7 @@ export class RateLimitService {
                 newValue
             );
 
-            // Set TTL using the client directly
+            // Set TTL using the client directly - this prevents the key from persisting forever
             if (redisManager.getClient()) {
                 await redisManager
                     .getClient()
@@ -170,6 +215,10 @@ export class RateLimitService {
 
         try {
             const globalKey = this.getRateLimitKey(clientId);
+            
+            // Clean up old timestamp fields before reading
+            await this.cleanupOldTimestamps(globalKey, windowStart);
+            
             const globalRateLimitData = await redisManager.hgetall(globalKey);
 
             let count = 0;
@@ -215,6 +264,10 @@ export class RateLimitService {
 
         try {
             const messageTypeKey = this.getMessageTypeRateLimitKey(clientId, messageType);
+            
+            // Clean up old timestamp fields before reading
+            await this.cleanupOldTimestamps(messageTypeKey, windowStart);
+            
             const messageTypeRateLimitData = await redisManager.hgetall(messageTypeKey);
 
             let count = 0;

server/private/lib/resend.ts

@@ -16,7 +16,7 @@ import privateConfig from "#private/lib/config";
 import logger from "@server/logger";
 
 export enum AudienceIds {
-  SignUps = "5cfbf99b-c592-40a9-9b8a-577a4681c158",
+  SignUps = "6c4e77b2-0851-4bd6-bac8-f51f91360f1a",
   Subscribed = "870b43fd-387f-44de-8fc1-707335f30b20",
   Churned = "f3ae92bd-2fdb-4d77-8746-2118afd62549",
   Newsletter = "5500c431-191c-42f0-a5d4-8b6d445b4ea0"

server/private/routers/hybrid.ts

@@ -227,6 +227,8 @@ export type UserSessionWithUser = {
 export const hybridRouter = Router();
 hybridRouter.use(verifySessionRemoteExitNodeMiddleware);
 
+// TODO: ADD RATE LIMITING TO THESE ROUTES AS NEEDED BASED ON USAGE PATTERNS
+
 hybridRouter.get(
     "/general-config",
     async (req: Request, res: Response, next: NextFunction) => {

server/private/routers/misc/index.ts

@@ -1 +1,14 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
 export * from "./sendSupportEmail";

server/private/routers/misc/sendSupportEmail.ts

@@ -68,7 +68,7 @@ export async function sendSupportEmail(
                 {
                     name: req.user?.email || "Support User",
                     to: "support@pangolin.net",
-                    from: req.user?.email || config.getNoReplyEmail(),
+                    from: config.getNoReplyEmail(),
                     subject: `Support Request: ${subject}`
                 }
             );

server/routers/auth/signup.ts

@@ -30,7 +30,8 @@ export const signupBodySchema = z.object({
     password: passwordSchema,
     inviteToken: z.string().optional(),
     inviteId: z.string().optional(),
-    termsAcceptedTimestamp: z.string().nullable().optional()
+    termsAcceptedTimestamp: z.string().nullable().optional(),
+    marketingEmailConsent: z.boolean().optional()
 });
 
 export type SignUpBody = z.infer<typeof signupBodySchema>;
@@ -55,7 +56,7 @@ export async function signup(
         );
     }
 
-    const { email, password, inviteToken, inviteId, termsAcceptedTimestamp } =
+    const { email, password, inviteToken, inviteId, termsAcceptedTimestamp, marketingEmailConsent } =
         parsedBody.data;
 
     const passwordHash = await hashPassword(password);
@@ -220,8 +221,8 @@ export async function signup(
             new Date(sess.expiresAt)
         );
         res.appendHeader("Set-Cookie", cookie);
-
-        if (build == "saas") {
+        if (build == "saas" && marketingEmailConsent) {
+            logger.debug(`User ${email} opted in to marketing emails during signup.`);
             moveEmailToAudience(email, AudienceIds.SignUps);
         }
 

src/components/SignupForm.tsx

@@ -92,7 +92,8 @@ const formSchema = z
                 message:
                     "You must agree to the terms of service and privacy policy"
             }
-        )
+        ),
+        marketingEmailConsent: z.boolean().optional()
     })
     .refine((data) => data.password === data.confirmPassword, {
         path: ["confirmPassword"],
@@ -123,7 +124,8 @@ export default function SignupForm({
             email: emailParam || "",
             password: "",
             confirmPassword: "",
-            agreeToTerms: false
+            agreeToTerms: false,
+            marketingEmailConsent: false
         },
         mode: "onChange" // Enable real-time validation
     });
@@ -135,7 +137,7 @@ export default function SignupForm({
         passwordValue === confirmPasswordValue;
 
     async function onSubmit(values: z.infer<typeof formSchema>) {
-        const { email, password } = values;
+        const { email, password, marketingEmailConsent } = values;
 
         setLoading(true);
         const res = await api
@@ -144,7 +146,8 @@ export default function SignupForm({
                 password,
                 inviteId,
                 inviteToken,
-                termsAcceptedTimestamp: termsAgreedAt
+                termsAcceptedTimestamp: termsAgreedAt,
+                marketingEmailConsent: build === "saas" ? marketingEmailConsent : undefined
             })
             .catch((e) => {
                 console.error(e);
@@ -489,56 +492,78 @@ export default function SignupForm({
                             )}
                         />
                         {build === "saas" && (
-                            <FormField
-                                control={form.control}
-                                name="agreeToTerms"
-                                render={({ field }) => (
-                                    <FormItem className="flex flex-row items-center">
-                                        <FormControl>
-                                            <Checkbox
-                                                checked={field.value}
-                                                onCheckedChange={(checked) => {
-                                                    field.onChange(checked);
-                                                    handleTermsChange(
-                                                        checked as boolean
-                                                    );
-                                                }}
-                                            />
-                                        </FormControl>
-                                        <div className="leading-none">
-                                            <FormLabel className="text-sm font-normal">
-                                                <div>
-                                                    {t(
-                                                        "signUpTerms.IAgreeToThe"
-                                                    )}{" "}
-                                                    <a
-                                                        href="https://pangolin.net/terms-of-service.html"
-                                                        target="_blank"
-                                                        rel="noopener noreferrer"
-                                                        className="text-primary hover:underline"
-                                                    >
+                            <>
+                                <FormField
+                                    control={form.control}
+                                    name="agreeToTerms"
+                                    render={({ field }) => (
+                                        <FormItem className="flex flex-row items-center">
+                                            <FormControl>
+                                                <Checkbox
+                                                    checked={field.value}
+                                                    onCheckedChange={(checked) => {
+                                                        field.onChange(checked);
+                                                        handleTermsChange(
+                                                            checked as boolean
+                                                        );
+                                                    }}
+                                                />
+                                            </FormControl>
+                                            <div className="leading-none">
+                                                <FormLabel className="text-sm font-normal">
+                                                    <div>
                                                         {t(
-                                                            "signUpTerms.termsOfService"
+                                                            "signUpTerms.IAgreeToThe"
                                                         )}{" "}
-                                                    </a>
-                                                    {t("signUpTerms.and")}{" "}
-                                                    <a
-                                                        href="https://pangolin.net/privacy-policy.html"
-                                                        target="_blank"
-                                                        rel="noopener noreferrer"
-                                                        className="text-primary hover:underline"
-                                                    >
-                                                        {t(
-                                                            "signUpTerms.privacyPolicy"
-                                                        )}
-                                                    </a>
-                                                </div>
-                                            </FormLabel>
-                                            <FormMessage />
-                                        </div>
-                                    </FormItem>
-                                )}
-                            />
+                                                        <a
+                                                            href="https://pangolin.net/terms-of-service.html"
+                                                            target="_blank"
+                                                            rel="noopener noreferrer"
+                                                            className="text-primary hover:underline"
+                                                        >
+                                                            {t(
+                                                                "signUpTerms.termsOfService"
+                                                            )}{" "}
+                                                        </a>
+                                                        {t("signUpTerms.and")}{" "}
+                                                        <a
+                                                            href="https://pangolin.net/privacy-policy.html"
+                                                            target="_blank"
+                                                            rel="noopener noreferrer"
+                                                            className="text-primary hover:underline"
+                                                        >
+                                                            {t(
+                                                                "signUpTerms.privacyPolicy"
+                                                            )}
+                                                        </a>
+                                                    </div>
+                                                </FormLabel>
+                                                <FormMessage />
+                                            </div>
+                                        </FormItem>
+                                    )}
+                                />
+                                <FormField
+                                    control={form.control}
+                                    name="marketingEmailConsent"
+                                    render={({ field }) => (
+                                        <FormItem className="flex flex-row items-start">
+                                            <FormControl>
+                                                <Checkbox
+                                                    checked={field.value}
+                                                    onCheckedChange={field.onChange}
+                                                />
+                                            </FormControl>
+                                            <div className="leading-none">
+                                                <FormLabel className="text-sm font-normal">
+                                                    {t("signUpMarketing.keepMeInTheLoop")}
+                                                </FormLabel>
+                                                <FormMessage />
+                                            </div>
+                                        </FormItem>
+                                    )}
+                                />
+                            </>
                         )}
 
                         {error && (