mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
* chore(deps): Clear high-severity CVE baseline and harden the security gate - Bump OpenTelemetry stack to 0.221.x (fixes @opentelemetry/core advisories) - Bump @larksuiteoapi/node-sdk to ^1.73.0 and override axios to ^1.19.0 - Bump mobilewright to ^0.0.53 (drops vulnerable sharp 0.34.x) - Bump markdown-it to ^15.0.0 (drops vulnerable linkify-it 5.x) - Update undici/fast-uri/brace-expansion/ip-address within range - Adapt telemetry code to OTel API changes (forceFlush, processor options) - Make security-checks a hard gate now that the high baseline is clean * chore(deps): Refresh mobile-mcp vendored lockfile to drop vulnerable sharp * fix(telemetry): stub sdk-node 0.221 env auto-config helper packages sdk-node 0.221 extracted its env-based auto-configuration into @opentelemetry/configuration, otlp-exporter-base, and otlp-grpc-exporter-base, which it now requires eagerly. The existing esbuild stub only covered the exporter-* packages, so the OTLP protocol chain (grpc-js, protobufjs, otlp-transformer) re-entered the sdk-impl static closure and tripped the serve fast-path bundle guard. Stub the three helper packages when imported by sdk-node only; our own protocol modules keep resolving the real packages. qwen-code never reaches these helpers at runtime (explicit exporters + env scrub). * fix(telemetry): disable metrics fallback without reader * fix(vscode): restore nested dependency notices * fix(deps): declare bundled punycode so its notice survives regeneration The CLI esbuild config aliases punycode to the userland package (esbuild.config.js), so the shipped CLI bundle contains MIT-licensed [email protected]. Its NOTICES.txt section was lost because the only lockfile paths reaching punycode were dev-only; the notice walker (rooted at vscode-ide-companion) never sees a production declaration. Declare punycode as a direct production dependency of the CLI (the bundle input) and of vscode-ide-companion (which packages the bundled CLI into the VSIX and owns NOTICES.txt), then regenerate the lockfile and notices so the MIT notice is restored.
150 lines
4.7 KiB
JavaScript
150 lines
4.7 KiB
JavaScript
/**
|
|
* @license
|
|
* Copyright 2026 Qwen Team
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
SDK_NODE_STUBBED_EXPORTERS,
|
|
isStubbedSdkNodeExporterImport,
|
|
} from '../sdk-node-exporter-stub.js';
|
|
|
|
// Importer paths as esbuild reports them, per OS. sdk-node lives one level up
|
|
// from the exporter package inside node_modules; the decision must hold
|
|
// regardless of the path separator (Windows is the ⚠️ platform in the matrix).
|
|
const POSIX_SDK_NODE_IMPORTER =
|
|
'/repo/node_modules/@opentelemetry/sdk-node/build/src/sdk.js';
|
|
const WINDOWS_SDK_NODE_IMPORTER =
|
|
'C:\\repo\\node_modules\\@opentelemetry\\sdk-node\\build\\src\\sdk.js';
|
|
const POSIX_OWN_MODULE_IMPORTER =
|
|
'/repo/packages/core/src/telemetry/sdk-exporters-grpc.ts';
|
|
const WINDOWS_OWN_MODULE_IMPORTER =
|
|
'C:\\repo\\packages\\core\\src\\telemetry\\sdk-exporters-http.ts';
|
|
|
|
describe('SDK_NODE_STUBBED_EXPORTERS', () => {
|
|
it('matches the OTLP exporter packages across every transport', () => {
|
|
for (const signal of ['trace', 'logs', 'metrics']) {
|
|
for (const transport of ['grpc', 'http', 'proto']) {
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test(
|
|
`@opentelemetry/exporter-${signal}-otlp-${transport}`,
|
|
),
|
|
).toBe(true);
|
|
}
|
|
}
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/exporter-zipkin'),
|
|
).toBe(true);
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/exporter-prometheus'),
|
|
).toBe(true);
|
|
});
|
|
|
|
it('matches the sdk-node 0.221 env auto-configuration helper packages', () => {
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/configuration'),
|
|
).toBe(true);
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/otlp-exporter-base'),
|
|
).toBe(true);
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/otlp-grpc-exporter-base'),
|
|
).toBe(true);
|
|
});
|
|
|
|
it('does not match non-exporter or unrelated packages', () => {
|
|
expect(SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/sdk-node')).toBe(
|
|
false,
|
|
);
|
|
expect(SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/api')).toBe(false);
|
|
// Subpath imports must not match — the anchor is end-of-string.
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test(
|
|
'@opentelemetry/exporter-trace-otlp-grpc/build/src/index.js',
|
|
),
|
|
).toBe(false);
|
|
expect(
|
|
SDK_NODE_STUBBED_EXPORTERS.test(
|
|
'@opentelemetry/configuration/build/src/index.js',
|
|
),
|
|
).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('isStubbedSdkNodeExporterImport', () => {
|
|
it('stubs a stubbed exporter imported by sdk-node on POSIX and Windows', () => {
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-trace-otlp-grpc',
|
|
POSIX_SDK_NODE_IMPORTER,
|
|
),
|
|
).toBe(true);
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-metrics-otlp-http',
|
|
WINDOWS_SDK_NODE_IMPORTER,
|
|
),
|
|
).toBe(true);
|
|
});
|
|
|
|
it('leaves the real package for our own protocol modules', () => {
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-trace-otlp-grpc',
|
|
POSIX_OWN_MODULE_IMPORTER,
|
|
),
|
|
).toBe(false);
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-metrics-otlp-http',
|
|
WINDOWS_OWN_MODULE_IMPORTER,
|
|
),
|
|
).toBe(false);
|
|
});
|
|
|
|
it('stubs the 0.221 helper packages only when sdk-node imports them', () => {
|
|
for (const packageName of [
|
|
'@opentelemetry/configuration',
|
|
'@opentelemetry/otlp-exporter-base',
|
|
'@opentelemetry/otlp-grpc-exporter-base',
|
|
]) {
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(packageName, POSIX_SDK_NODE_IMPORTER),
|
|
).toBe(true);
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(packageName, WINDOWS_SDK_NODE_IMPORTER),
|
|
).toBe(true);
|
|
// The HTTP protocol module legitimately reaches otlp-exporter-base via
|
|
// the exporter packages; it must keep resolving the real one.
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(packageName, POSIX_OWN_MODULE_IMPORTER),
|
|
).toBe(false);
|
|
}
|
|
});
|
|
|
|
it('does not stub non-exporter packages even when sdk-node imports them', () => {
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/otlp-transformer',
|
|
POSIX_SDK_NODE_IMPORTER,
|
|
),
|
|
).toBe(false);
|
|
});
|
|
|
|
it('is safe against a missing or empty importer', () => {
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-trace-otlp-grpc',
|
|
undefined,
|
|
),
|
|
).toBe(false);
|
|
expect(
|
|
isStubbedSdkNodeExporterImport(
|
|
'@opentelemetry/exporter-trace-otlp-grpc',
|
|
'',
|
|
),
|
|
).toBe(false);
|
|
});
|
|
});
|