Eric Allam
936bddf198
## Summary - Upgrades Node.js from 20.19.0 to 20.20.0 (and 22.12.0 to 22.22.0 for supervisor) to address the async_hooks stack overflow DoS vulnerability - Adds `maxDepth` parameter (default 128) to `flattenAttributes` and `unflattenAttributes` to prevent stack overflow on maliciously deep nested structures ## Details The vulnerability (patched in Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0) causes unrecoverable crashes (exit code 7) when stack overflow occurs during async_hooks callbacks. Since the webapp uses `AsyncLocalStorage`, it was theoretically vulnerable. ### Changes **Node.js version updates:** - `docker/Dockerfile`: 20.11.1 → 20.20.0 - `apps/supervisor/Containerfile`: 22-alpine → 22.22.0-alpine - `.nvmrc`: 20.19.0 → 20.20.0 - `apps/supervisor/.nvmrc`: 22.12.0 → 22.22.0 - `references/prisma-7/.nvmrc`: 20.19.0 → 20.20.0 - All GitHub workflows: 20.19.0 → 20.20.0 **Defense in depth:** - Added `maxDepth` parameter to `flattenAttributes()` and `unflattenAttributes()` in `packages/core` to prevent stack overflow on deeply nested user input ## Test plan - [x] All existing `flattenAttributes` tests pass (50 tests) - [x] New tests for depth limiting added - [x] Verify Docker builds work with new base images
103 lines
2.8 KiB
YAML
103 lines
2.8 KiB
YAML
name: 🦋 Changesets PR
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "packages/**"
|
|
- ".changeset/**"
|
|
- "package.json"
|
|
- "pnpm-lock.yaml"
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
release-pr:
|
|
name: Create Release PR
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
if: github.repository == 'triggerdotdev/trigger.dev'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
|
|
- name: Setup node
|
|
uses: buildjet/setup-node@v4
|
|
with:
|
|
node-version: 20.20.0
|
|
cache: "pnpm"
|
|
|
|
- name: Install dependencies
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Create release PR
|
|
id: changesets
|
|
uses: changesets/action@v1
|
|
with:
|
|
version: pnpm run changeset:version
|
|
commit: "chore: release"
|
|
title: "chore: release"
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Update PR title with version
|
|
if: steps.changesets.outputs.published != 'true'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
PR_NUMBER=$(gh pr list --head changeset-release/main --json number --jq '.[0].number')
|
|
if [ -n "$PR_NUMBER" ]; then
|
|
git fetch origin changeset-release/main
|
|
# we arbitrarily reference the version of the cli package here; it is the same for all package releases
|
|
VERSION=$(git show origin/changeset-release/main:packages/cli-v3/package.json | jq -r '.version')
|
|
gh pr edit "$PR_NUMBER" --title "chore: release v$VERSION"
|
|
fi
|
|
|
|
update-lockfile:
|
|
name: Update lockfile on release PR
|
|
runs-on: ubuntu-latest
|
|
needs: release-pr
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout release branch
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: changeset-release/main
|
|
|
|
- name: Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10.23.0
|
|
|
|
- name: Setup node
|
|
uses: buildjet/setup-node@v4
|
|
with:
|
|
node-version: 20.20.0
|
|
|
|
- name: Install and update lockfile
|
|
run: pnpm install --no-frozen-lockfile
|
|
|
|
- name: Commit and push lockfile
|
|
run: |
|
|
set -e
|
|
if git diff --quiet pnpm-lock.yaml; then
|
|
echo "No lockfile changes"
|
|
else
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "github-actions[bot]@users.noreply.github.com"
|
|
git add pnpm-lock.yaml
|
|
git commit -m "chore: update lockfile for release"
|
|
git push origin changeset-release/main
|
|
fi
|