Eric Allam
936bddf198
## Summary - Upgrades Node.js from 20.19.0 to 20.20.0 (and 22.12.0 to 22.22.0 for supervisor) to address the async_hooks stack overflow DoS vulnerability - Adds `maxDepth` parameter (default 128) to `flattenAttributes` and `unflattenAttributes` to prevent stack overflow on maliciously deep nested structures ## Details The vulnerability (patched in Node.js 20.20.0, 22.22.0, 24.13.0, 25.3.0) causes unrecoverable crashes (exit code 7) when stack overflow occurs during async_hooks callbacks. Since the webapp uses `AsyncLocalStorage`, it was theoretically vulnerable. ### Changes **Node.js version updates:** - `docker/Dockerfile`: 20.11.1 → 20.20.0 - `apps/supervisor/Containerfile`: 22-alpine → 22.22.0-alpine - `.nvmrc`: 20.19.0 → 20.20.0 - `apps/supervisor/.nvmrc`: 22.12.0 → 22.22.0 - `references/prisma-7/.nvmrc`: 20.19.0 → 20.20.0 - All GitHub workflows: 20.19.0 → 20.20.0 **Defense in depth:** - Added `maxDepth` parameter to `flattenAttributes()` and `unflattenAttributes()` in `packages/core` to prevent stack overflow on deeply nested user input ## Test plan - [x] All existing `flattenAttributes` tests pass (50 tests) - [x] New tests for depth limiting added - [x] Verify Docker builds work with new base images
60 lines
1.4 KiB
YAML
60 lines
1.4 KiB
YAML
name: "E2E"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
package:
|
|
description: The identifier of the job to run
|
|
default: webapp
|
|
required: false
|
|
type: string
|
|
|
|
jobs:
|
|
cli-v3:
|
|
name: "🧪 CLI v3 tests (${{ matrix.os }} - ${{ matrix.package-manager }})"
|
|
if: inputs.package == 'cli-v3' || inputs.package == ''
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os: [ubuntu-latest, windows-latest]
|
|
package-manager: ["npm", "pnpm"]
|
|
steps:
|
|
- name: ⬇️ Checkout repo
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: ⎔ Setup pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10.23.0
|
|
|
|
- name: ⎔ Setup node
|
|
uses: buildjet/setup-node@v4
|
|
with:
|
|
node-version: 20.20.0
|
|
|
|
- name: 📥 Download deps
|
|
run: pnpm install --frozen-lockfile --filter trigger.dev...
|
|
|
|
- name: 📀 Generate Prisma Client
|
|
run: pnpm run generate
|
|
|
|
- name: 🔧 Build v3 cli monorepo dependencies
|
|
run: pnpm run build --filter trigger.dev^...
|
|
|
|
- name: 🔧 Build worker template files
|
|
run: pnpm --filter trigger.dev run build:workers
|
|
|
|
- name: Enable corepack
|
|
run: corepack enable
|
|
|
|
- name: Run E2E Tests
|
|
shell: bash
|
|
run: |
|
|
LOG=debug PM=${{ matrix.package-manager }} pnpm --filter trigger.dev run test:e2e
|