fix(security): @hey-api/openapi-ts updated due dependabot warnings - #13487
Conversation
2c25b51 to
f9ddb78
Compare
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (15 files)
Reviewed by grok-4.6 · Input: 126.1K · Output: 17.2K · Cached: 937.5K Review guidance: REVIEW.md from base branch |
| // to do with HTTP errors, and any consumer that calls `.return()` or returns | ||
| // from a mock generator gets type-checked against the wrong shape. Drop the | ||
| // arg so TReturn defaults to void. | ||
| const sseTypesPath = "./src/v2/gen/client/types.gen.ts" |
There was a problem hiding this comment.
So with the update this bug is not present anymore? Or why can we remove this?
There was a problem hiding this comment.
it's in Changes:
removed the now-obsolete SseFn codegen patch (the bug it worked around is fixed upstream in 0.97.3)
There was a problem hiding this comment.
I also think it's low risk to keep this in but I usually take a chance to remove indirect 3rd party related patches any time, specially when we changed/bumped their version, to be sure we avoid side effects introduced by the patch maybe applied somewhere else (before, 'cause it's not even a global replacement)
There was a problem hiding this comment.
There was a problem hiding this comment.
Great thanks for clarifying
2 participants
What
Bumps
@hey-api/openapi-tsfrom0.90.10to0.97.3inpackages/sdk/jsand regenerates the committed SDK (packages/sdk/js/src/v2/gen).Why
Resolves Dependabot advisory GHSA-hhx9-57xq-r5rw / CVE-2026-48819 (prototype pollution, CWE-1321): the
buildClientParamstemplate copied into every generated SDK wrote unknown$<slot>___proto__keys directly into the slot object, letting$query___proto__substitute theparams.queryprototype chain. Fixed in0.97.3by building slots withObject.create(null). The regeneratedcore/params.gen.tsnow carries the fix.Changes
packages/sdk/js/package.json+bun.lock:@hey-api/openapi-ts0.90.10→0.97.3packages/sdk/js/src/v2/gen/**: regenerated SDK (includes the null-prototype params fix)packages/sdk/js/script/build.ts: removed the now-obsolete SseFn codegen patch (the bug it worked around is fixed upstream in 0.97.3)packages/opencode/test/server/httpapi-sdk.test.ts: adapted to the regenerated client typing whererequest/responseare now optional (kilocode_change-marked).changeset/hey-api-security-update.md:patchchangeset for@kilocode/sdkVerification
bun ./packages/sdk/js/script/build.ts(patches apply,tscclean)httpapi-sdk.test.ts: 21 passbun turbo typecheck(all packages exceptkilo-jetbrains): 29/29 pass — JetBrains needs a Java 21 toolchain not present on this machinebun run lint: 0 errorsbun run script/check-opencode-annotations.ts --worktree: clean