Skip to content

upstream: merge commits up to 46f1b25#216

Merged
billyvg merged 18 commits intosentry-v2from
sentry-v2-update-to-46f1b252a5919c68c68e825bd6089cc2e7d34e7c
Sep 6, 2024
Merged

upstream: merge commits up to 46f1b25#216
billyvg merged 18 commits intosentry-v2from
sentry-v2-update-to-46f1b252a5919c68c68e825bd6089cc2e7d34e7c

Conversation

eoghanmurray and others added 14 commits May 1, 2024 17:14
* Ensure there is separation of timestamps so mutations can be evaluated separately - was failing in the github build process probably due to higher perf

* Remove space from test file

* Create curvy-balloons-brake.md

---------

Co-authored-by: Justin Halsall <Juice10@users.noreply.github.com>
perf(snapshot): avoid costly generation of <a> element on each call to `getHref`, instead cache an anchor element and reuse it's href attributed

---------

Co-authored-by: Eoghan Murray <eoghan@getthere.ie>
…later modified (rrweb-io#1467)

* Fix that blob urls persist on the shared anchor element and can't be later modified

* Create nervous-kiwis-nail.md
Some dev improvements:
* Add .editorconfig config file https://editorconfig.org/
* move the singleQuote spec into .editorconfig and add old .changesets/*.md to .prettierignore so that we don't incorrectly reformat new changeset files to single quote from the double quote which they can be autogenerated with in github
* .gitignore Ignore emacs chaff files
* Add `yarn format:head` a convenience command to run prettier against just those files in the head commit
* Some mention of `yarn format` in the docs
* Fix some test html closing tags; authoring mistakes, rather than deliberately malformed html — picked up by an explicit `yarn prettier --write '**/*.html'`
* Fix that the `.replace()` function only replaces the first occurrence

* This should have been included in rrweb-io#1174

* Create fast-pets-exist.md
This work is to try to provide support where rrweb might be included
in applications with various tools that might override Array.from
so that the 2nd parameter (the map function) will always work for
rrweb.

Co-authored-by: Michael Dellanoce <mdellanoce@pendo.io>
* Fix and test for bug rrweb-io#1457 (Uncaught SyntaxError: Regular expression too large)

 - see test case which is extracted from a real world css file; the selector regex was able to traverse the curly brace as when looking for quotes, it wasn't taking into account that the start quote could be escaped

* Apply formatting changes

* Create fair-ducks-clean.md

* Fix @import regex bit which was stopping consumption in the middle of a url - need to consume quotes.

Thanks dave.kindel@pendo.io for reporting and isolating this case

---------

Co-authored-by: eoghanmurray <eoghanmurray@users.noreply.github.com>
This work is to try to provide support where rrweb might be included
in applications with various tools that might override Array.from
so that the 2nd parameter (the map function) will always work for
rrweb.

Co-authored-by: Michael Dellanoce <mdellanoce@pendo.io>
…update-e96f668c86bd0ab5dc190bb2957a170271bb2ebc
@billyvg billyvg changed the title Ensure there is separation of timestamps (#1455) upstream: merge commits up to 46f1b25 Aug 27, 2024
return customHref;
}
// note: using `new URL` is slower. See #1434 or https://jsbench.me/uqlud17rxo/1
a.setAttribute('href', customHref);

Check warning

Code scanning / CodeQL

DOM text reinterpreted as HTML

[DOM text](1) is reinterpreted as HTML without escaping meta-characters. [DOM text](2) is reinterpreted as HTML without escaping meta-characters. [DOM text](3) is reinterpreted as HTML without escaping meta-characters.
@billyvg billyvg marked this pull request as ready for review August 27, 2024 21:27
@billyvg billyvg requested a review from a team August 29, 2024 17:34
@billyvg billyvg merged commit 50b54a9 into sentry-v2 Sep 6, 2024
@billyvg billyvg deleted the sentry-v2-update-to-46f1b252a5919c68c68e825bd6089cc2e7d34e7c branch September 6, 2024 14:51
billyvg added a commit to getsentry/sentry-javascript that referenced this pull request Sep 10, 2024
billyvg added a commit to getsentry/sentry-javascript that referenced this pull request Sep 10, 2024
chargome added a commit that referenced this pull request Mar 25, 2026
Remove lerna and replace its two uses with lighter alternatives:

- **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node
script that updates all workspace `package.json` versions and
`@sentry-internal/*` cross-references to the exact new version. Modeled
after
[sentry-javascript#19325](getsentry/sentry-javascript#19325).
- **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo
is already used for all other cross-package tasks.

Lerna was pulling in a large transitive dependency tree including
packages with known vulnerabilities. This removes ~2,300 lines from
`yarn.lock`.

### Dependabot alerts resolved

**Fully resolved** (vulnerable package completely removed from
lockfile):

| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative
Linkpath |
| #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative
Linkpath |
| #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target
Escape Through Symlink Chain |
| #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink
Path Traversal |
| #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions
on macOS APFS |
| #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning
via Insufficient Path Sanitization |
| #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL |

**Partially resolved** (some vulnerable entries removed, but the package
still exists via other dependency chains):

| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`,
`vite-plugin-dts` still pull in vulnerable versions |
| #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in
vulnerable versions |
| #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls
in `form-data@3.0.2` |
| #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull
in `js-yaml@3.14.1` |

The partially resolved alerts will be addressed in later phases (Phase
6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`,
`jest`/rrvideo, etc.).

Part of the ongoing effort to resolve all Dependabot alerts on this
repo.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants