Files
qwen-code/scripts/tests/sdk-node-exporter-stub.test.js
易良 e40263ee55 chore(deps): Clear high-severity CVE baseline and harden the security gate (#9584)
* chore(deps): Clear high-severity CVE baseline and harden the security gate

- Bump OpenTelemetry stack to 0.221.x (fixes @opentelemetry/core advisories)
- Bump @larksuiteoapi/node-sdk to ^1.73.0 and override axios to ^1.19.0
- Bump mobilewright to ^0.0.53 (drops vulnerable sharp 0.34.x)
- Bump markdown-it to ^15.0.0 (drops vulnerable linkify-it 5.x)
- Update undici/fast-uri/brace-expansion/ip-address within range
- Adapt telemetry code to OTel API changes (forceFlush, processor options)
- Make security-checks a hard gate now that the high baseline is clean

* chore(deps): Refresh mobile-mcp vendored lockfile to drop vulnerable sharp

* fix(telemetry): stub sdk-node 0.221 env auto-config helper packages

sdk-node 0.221 extracted its env-based auto-configuration into
@opentelemetry/configuration, otlp-exporter-base, and
otlp-grpc-exporter-base, which it now requires eagerly. The existing
esbuild stub only covered the exporter-* packages, so the OTLP protocol
chain (grpc-js, protobufjs, otlp-transformer) re-entered the sdk-impl
static closure and tripped the serve fast-path bundle guard.

Stub the three helper packages when imported by sdk-node only; our own
protocol modules keep resolving the real packages. qwen-code never
reaches these helpers at runtime (explicit exporters + env scrub).

* fix(telemetry): disable metrics fallback without reader

* fix(vscode): restore nested dependency notices

* fix(deps): declare bundled punycode so its notice survives regeneration

The CLI esbuild config aliases punycode to the userland package
(esbuild.config.js), so the shipped CLI bundle contains MIT-licensed
[email protected]. Its NOTICES.txt section was lost because the only
lockfile paths reaching punycode were dev-only; the notice walker
(rooted at vscode-ide-companion) never sees a production declaration.

Declare punycode as a direct production dependency of the CLI (the
bundle input) and of vscode-ide-companion (which packages the bundled
CLI into the VSIX and owns NOTICES.txt), then regenerate the lockfile
and notices so the MIT notice is restored.
2026-08-21 07:43:32 +00:00

150 lines
4.7 KiB
JavaScript

/**
* @license
* Copyright 2026 Qwen Team
* SPDX-License-Identifier: Apache-2.0
*/
import { describe, expect, it } from 'vitest';
import {
SDK_NODE_STUBBED_EXPORTERS,
isStubbedSdkNodeExporterImport,
} from '../sdk-node-exporter-stub.js';
// Importer paths as esbuild reports them, per OS. sdk-node lives one level up
// from the exporter package inside node_modules; the decision must hold
// regardless of the path separator (Windows is the ⚠️ platform in the matrix).
const POSIX_SDK_NODE_IMPORTER =
'/repo/node_modules/@opentelemetry/sdk-node/build/src/sdk.js';
const WINDOWS_SDK_NODE_IMPORTER =
'C:\\repo\\node_modules\\@opentelemetry\\sdk-node\\build\\src\\sdk.js';
const POSIX_OWN_MODULE_IMPORTER =
'/repo/packages/core/src/telemetry/sdk-exporters-grpc.ts';
const WINDOWS_OWN_MODULE_IMPORTER =
'C:\\repo\\packages\\core\\src\\telemetry\\sdk-exporters-http.ts';
describe('SDK_NODE_STUBBED_EXPORTERS', () => {
it('matches the OTLP exporter packages across every transport', () => {
for (const signal of ['trace', 'logs', 'metrics']) {
for (const transport of ['grpc', 'http', 'proto']) {
expect(
SDK_NODE_STUBBED_EXPORTERS.test(
`@opentelemetry/exporter-${signal}-otlp-${transport}`,
),
).toBe(true);
}
}
expect(
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/exporter-zipkin'),
).toBe(true);
expect(
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/exporter-prometheus'),
).toBe(true);
});
it('matches the sdk-node 0.221 env auto-configuration helper packages', () => {
expect(
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/configuration'),
).toBe(true);
expect(
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/otlp-exporter-base'),
).toBe(true);
expect(
SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/otlp-grpc-exporter-base'),
).toBe(true);
});
it('does not match non-exporter or unrelated packages', () => {
expect(SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/sdk-node')).toBe(
false,
);
expect(SDK_NODE_STUBBED_EXPORTERS.test('@opentelemetry/api')).toBe(false);
// Subpath imports must not match — the anchor is end-of-string.
expect(
SDK_NODE_STUBBED_EXPORTERS.test(
'@opentelemetry/exporter-trace-otlp-grpc/build/src/index.js',
),
).toBe(false);
expect(
SDK_NODE_STUBBED_EXPORTERS.test(
'@opentelemetry/configuration/build/src/index.js',
),
).toBe(false);
});
});
describe('isStubbedSdkNodeExporterImport', () => {
it('stubs a stubbed exporter imported by sdk-node on POSIX and Windows', () => {
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-trace-otlp-grpc',
POSIX_SDK_NODE_IMPORTER,
),
).toBe(true);
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-metrics-otlp-http',
WINDOWS_SDK_NODE_IMPORTER,
),
).toBe(true);
});
it('leaves the real package for our own protocol modules', () => {
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-trace-otlp-grpc',
POSIX_OWN_MODULE_IMPORTER,
),
).toBe(false);
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-metrics-otlp-http',
WINDOWS_OWN_MODULE_IMPORTER,
),
).toBe(false);
});
it('stubs the 0.221 helper packages only when sdk-node imports them', () => {
for (const packageName of [
'@opentelemetry/configuration',
'@opentelemetry/otlp-exporter-base',
'@opentelemetry/otlp-grpc-exporter-base',
]) {
expect(
isStubbedSdkNodeExporterImport(packageName, POSIX_SDK_NODE_IMPORTER),
).toBe(true);
expect(
isStubbedSdkNodeExporterImport(packageName, WINDOWS_SDK_NODE_IMPORTER),
).toBe(true);
// The HTTP protocol module legitimately reaches otlp-exporter-base via
// the exporter packages; it must keep resolving the real one.
expect(
isStubbedSdkNodeExporterImport(packageName, POSIX_OWN_MODULE_IMPORTER),
).toBe(false);
}
});
it('does not stub non-exporter packages even when sdk-node imports them', () => {
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/otlp-transformer',
POSIX_SDK_NODE_IMPORTER,
),
).toBe(false);
});
it('is safe against a missing or empty importer', () => {
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-trace-otlp-grpc',
undefined,
),
).toBe(false);
expect(
isStubbedSdkNodeExporterImport(
'@opentelemetry/exporter-trace-otlp-grpc',
'',
),
).toBe(false);
});
});