Affected by GO-2026-6560
and 1 other vulnerabilities
GO-2026-6560: Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter in github.com/hatchet-dev/hatchet
GO-2026-6565: Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler in hatchet-dev/hatchet
patch-api-resources patches the generated Api.ts file to attach x-resources
metadata from the OpenAPI spec to each API method, enabling callers to check
resource scope at runtime:
api.v1TaskGet.resources.has("tenant") // true
Run from the repo root after swagger-typescript-api generation:
Affected by 
Documentation
¶
Source Files