mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
易良
e40263ee55
* chore(deps): Clear high-severity CVE baseline and harden the security gate - Bump OpenTelemetry stack to 0.221.x (fixes @opentelemetry/core advisories) - Bump @larksuiteoapi/node-sdk to ^1.73.0 and override axios to ^1.19.0 - Bump mobilewright to ^0.0.53 (drops vulnerable sharp 0.34.x) - Bump markdown-it to ^15.0.0 (drops vulnerable linkify-it 5.x) - Update undici/fast-uri/brace-expansion/ip-address within range - Adapt telemetry code to OTel API changes (forceFlush, processor options) - Make security-checks a hard gate now that the high baseline is clean * chore(deps): Refresh mobile-mcp vendored lockfile to drop vulnerable sharp * fix(telemetry): stub sdk-node 0.221 env auto-config helper packages sdk-node 0.221 extracted its env-based auto-configuration into @opentelemetry/configuration, otlp-exporter-base, and otlp-grpc-exporter-base, which it now requires eagerly. The existing esbuild stub only covered the exporter-* packages, so the OTLP protocol chain (grpc-js, protobufjs, otlp-transformer) re-entered the sdk-impl static closure and tripped the serve fast-path bundle guard. Stub the three helper packages when imported by sdk-node only; our own protocol modules keep resolving the real packages. qwen-code never reaches these helpers at runtime (explicit exporters + env scrub). * fix(telemetry): disable metrics fallback without reader * fix(vscode): restore nested dependency notices * fix(deps): declare bundled punycode so its notice survives regeneration The CLI esbuild config aliases punycode to the userland package (esbuild.config.js), so the shipped CLI bundle contains MIT-licensed [email protected]. Its NOTICES.txt section was lost because the only lockfile paths reaching punycode were dev-only; the notice walker (rooted at vscode-ide-companion) never sees a production declaration. Declare punycode as a direct production dependency of the CLI (the bundle input) and of vscode-ide-companion (which packages the bundled CLI into the VSIX and owns NOTICES.txt), then regenerate the lockfile and notices so the MIT notice is restored.
51 lines
2.0 KiB
JavaScript
51 lines
2.0 KiB
JavaScript
/**
|
|
* @license
|
|
* Copyright 2025 Google LLC
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
/**
|
|
* Shared logic for the esbuild plugin that stubs the OTLP exporter packages
|
|
* `@opentelemetry/sdk-node` eagerly require()s for env-based auto-configuration
|
|
* (issue #7264). Extracted from esbuild.config.js so the resolve decision — the
|
|
* security-critical part that keeps both protocol chains out of the sdk-impl
|
|
* static closure — is unit-testable without running a full bundle.
|
|
*/
|
|
|
|
// Exporter packages sdk-node eagerly require()s: the three OTLP signals across
|
|
// grpc/http/proto transports, plus zipkin and prometheus. From sdk-node 0.221
|
|
// on, the env auto-configuration helpers were extracted into
|
|
// `@opentelemetry/configuration`, `@opentelemetry/otlp-exporter-base`, and
|
|
// `@opentelemetry/otlp-grpc-exporter-base`, which sdk-node's utils/start
|
|
// modules now require eagerly; the grpc one pulls @grpc/grpc-js and
|
|
// protobufjs, so all three need the same stub treatment.
|
|
export const SDK_NODE_STUBBED_EXPORTERS = new RegExp(
|
|
'^@opentelemetry/(' +
|
|
[
|
|
'exporter-trace-otlp-(grpc|http|proto)',
|
|
'exporter-logs-otlp-(grpc|http|proto)',
|
|
'exporter-metrics-otlp-(grpc|http|proto)',
|
|
'exporter-zipkin',
|
|
'exporter-prometheus',
|
|
'configuration',
|
|
'otlp-exporter-base',
|
|
'otlp-grpc-exporter-base',
|
|
].join('|') +
|
|
')$',
|
|
);
|
|
|
|
/**
|
|
* Decide whether an esbuild import should resolve to the loud stub.
|
|
*
|
|
* True only when a stubbed exporter package is imported *by sdk-node itself* —
|
|
* our own protocol modules keep resolving the real packages. The importer path
|
|
* is normalized to forward slashes so the match holds on Windows (where esbuild
|
|
* emits backslash-separated paths) as well as POSIX.
|
|
*/
|
|
export function isStubbedSdkNodeExporterImport(importPath, importer) {
|
|
if (!SDK_NODE_STUBBED_EXPORTERS.test(importPath)) return false;
|
|
if (typeof importer !== 'string' || importer.length === 0) return false;
|
|
const normalizedImporter = importer.replace(/\\/g, '/');
|
|
return normalizedImporter.includes('@opentelemetry/sdk-node');
|
|
}
|