chore: Bump Node deps & Trunk upgrade (#240)

Author: davidmytton

.trunk/trunk.yaml

@@ -2,29 +2,31 @@
 # To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
 version: 0.1
 cli:
-  version: 1.22.6
+  version: 1.22.10
 # Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
 plugins:
   sources:
     - id: trunk
-      ref: v1.6.3
+      ref: v1.6.7
       uri: https://github.com/trunk-io/plugins
 # Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
 runtimes:
   enabled:
-    - [email protected]
     - [email protected]
+  definitions:
+    - type: node
+      system_version: allowed
 # This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
 lint:
   enabled:
-    - [email protected].257
+    - [email protected].365
     - [email protected]
     - git-diff-check
-    - markdownlint@0.42.0
-    - [email protected].0
-    - prettier@3.3.3
-    - trivy@0.56.2
-    - trufflehog@3.82.8
+    - markdownlint@0.44.0
+    - [email protected].2
+    - prettier@3.4.2
+    - trivy@0.59.1
+    - trufflehog@3.88.4
     - [email protected]
 actions:
   enabled:

app/api/auth/[...nextauth]/route.ts

@@ -30,8 +30,9 @@ const aj = arcjet
 // Protect the sensitive actions e.g. login, signup, etc with Arcjet
 const ajProtectedPOST = async (req: NextRequest) => {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   const decision = await aj.protect(req, { fingerprint: userIp });
 
   if (decision.isDenied()) {

app/attack/test/route.ts

@@ -16,8 +16,9 @@ const aj = arcjet.withRule(
 
 export async function GET(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/bots/test/route.ts

@@ -26,8 +26,9 @@ const aj = arcjet
 
 export async function GET(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/rate-limiting/test/route.ts

@@ -46,8 +46,9 @@ export async function POST(req: NextRequest) {
   console.log("Session: ", session);
 
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
 
   // Use the user ID if the user is logged in, otherwise use the IP address
   const fingerprint = session?.user?.id ?? userIp;

app/sensitive-info/test/route.ts

@@ -26,8 +26,9 @@ const aj = arcjet
 
 export async function POST(req: NextRequest) {
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp });

app/signup/test/route.ts

@@ -57,8 +57,9 @@ export async function POST(req: NextRequest) {
   const { email } = data.data;
 
   // Next.js 15 doesn't provide the IP address in the request object so we use
-  // the Arcjet utility package to parse the headers and find it
-  const userIp = ip(req);
+  // the Arcjet utility package to parse the headers and find it. If we're
+  // running in development mode, we'll use a local IP address.
+  const userIp = process.env.NODE_ENV === "development" ? "127.0.0.1" : ip(req);
   // The protect method returns a decision object that contains information
   // about the request.
   const decision = await aj.protect(req, { fingerprint: userIp, email });

next-env.d.ts

@@ -2,4 +2,4 @@
 /// <reference types="next/image-types/global" />
 
 // NOTE: This file should not be edited
-// see https://nextjs.org/docs/app/building-your-application/configuring/typescript for more information.
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.