fix(deps): update dependency koa to v2.16.1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
koa	2.15.3 -> 2.16.1
koa	2.16.0 -> 2.16.1

GitHub Vulnerability Alerts

CVE-2025-32379

Summary

In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even after sanitizing it, may execute javascript code on the user who use the app.

Patches

This issue is patched in 2.16.1 and 3.0.0-alpha.5.

PoC

Coming soon...

Impact

1. Redirect user to another phishing site
2. Make request to another endpoint of the application based on user's cookie
3. Steal user's cookie

---

Release Notes

koajs/koa (koa)

v2.16.1

Compare Source

fix: don't render redirect values in anchor ref

v2.16.0

Compare Source

This is a backported release to fix core underlying issue with HEAD requests when using http2.createSecureServer. See discussion at https://github.com/koajs/koa/pull/1593 and https://github.com/koajs/koa/issues/1547.

• fix missing cleanup, if response socket is no longer writeable (issue 1547) (https://github.com/koajs/koa/pull/1593) 399cb6b

v2.15.4

Compare Source

Full Changelog: koajs/koa@2.15.3...2.15.4

Fix: avoid redos on host and protocol getter, see GHSA-593f-38f6-jp5m

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name	Link
🔨 Latest commit	20cf163
🔍 Latest deploy log	https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/68581bdf0016c700088070ea

[github-actions]

🚀 Performance Test Results

Test Configuration:

• VUs: 4
• Duration: 1m0s

Test Metrics:

• Requests/s: 44.25
• Iterations/s: 14.75
• Failed Requests: 0.00% (0 of 2660)

📜 Logs

> [email protected] run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test "-k" "-q" "--vus" "4" "--duration" "1m"

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 927 kB 15 kB/s
     data_sent......................: 1.9 MB 31 kB/s
     http_req_blocked...............: avg=5.82µs   min=1.8µs    med=4.93µs  max=548.79µs p(90)=6.24µs   p(95)=6.7µs   
     http_req_connecting............: avg=388ns    min=0s       med=0s      max=512.15µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=89.79ms  min=8.86ms   med=73.29ms max=631.59ms p(90)=157.33ms p(95)=181.79ms
       { expected_response:true }...: avg=89.79ms  min=8.86ms   med=73.29ms max=631.59ms p(90)=157.33ms p(95)=181.79ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 2660
     http_req_receiving.............: avg=79.05µs  min=23.1µs   med=72.3µs  max=1.66ms   p(90)=103.65µs p(95)=125.3µs 
     http_req_sending...............: avg=33.5µs   min=10.01µs  med=25.65µs max=2.34ms   p(90)=38.78µs  p(95)=52.5µs  
     http_req_tls_handshaking.......: avg=0s       min=0s       med=0s      max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=89.68ms  min=8.74ms   med=73.19ms max=631.52ms p(90)=157.26ms p(95)=181.68ms
     http_reqs......................: 2660   44.247021/s
     iteration_duration.............: avg=270.83ms min=147.16ms med=256.1ms max=1.19s    p(90)=334.39ms p(95)=361.16ms
     iterations.....................: 887    14.754552/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4