Skip to content

feat(apps): Migrate app management code from @rocket.chat/apps-engine to @rocket.chat/apps internal package - #40343

Merged
ggazzo merged 70 commits into
developfrom
feat/apps-engine-split--pr2d-remove-apps-engine-files
May 7, 2026
Merged

feat(apps): Migrate app management code from @rocket.chat/apps-engine to @rocket.chat/apps internal package#40343
ggazzo merged 70 commits into
developfrom
feat/apps-engine-split--pr2d-remove-apps-engine-files

update yarn.lock

673d4f7
Select commit
Loading
Failed to load commit list.
RC - Layne / Layne Security Scan failed May 7, 2026 in 17s

Layne — failure

Found 3 issue(s): 0 critical, 3 high, 0 medium, 0 low.

Blocking findings:

  • LAYNE-c62cb997f4757617 [semgrep/app.config.semgrep.rules.nodejs.child-process-execution] packages/apps/scripts/deno-cache.js:39
  • LAYNE-b7a114d497e516af [semgrep/app.config.semgrep.rules.nodejs.child-process-execution] packages/apps/scripts/deno-cache.js:82
  • LAYNE-8fde114514b41f27 [semgrep/app.config.semgrep.rules.nodejs.child-process-execution] packages/apps/src/server/runtime/deno/AppsEngineDenoRuntime.ts:249

To approve, post a comment:
/layne exception-approve LAYNE-c62cb997f4757617 LAYNE-b7a114d497e516af LAYNE-8fde114514b41f27 reason:

Annotations

Check failure on line 39 in packages/apps/scripts/deno-cache.js

See this annotation in the file changed.

@rc-layne rc-layne / Layne Security Scan

[semgrep] app.config.semgrep.rules.nodejs.child-process-execution 

[R39] Child process execution detected. Ensure command and arguments are not user-controlled.
Command injection (CWE-78) can occur if untrusted input flows into spawn/exec calls.
Remediation:
  - Use allowlists for permitted commands
  - Validate/sanitize all arguments
  - Avoid shell=True or string-based command interpolation
  - Prefer execFile/spawn over exec when possible

Check failure on line 82 in packages/apps/scripts/deno-cache.js

See this annotation in the file changed.

@rc-layne rc-layne / Layne Security Scan

[semgrep] app.config.semgrep.rules.nodejs.child-process-execution 

[R82] Child process execution detected. Ensure command and arguments are not user-controlled.
Command injection (CWE-78) can occur if untrusted input flows into spawn/exec calls.
Remediation:
  - Use allowlists for permitted commands
  - Validate/sanitize all arguments
  - Avoid shell=True or string-based command interpolation
  - Prefer execFile/spawn over exec when possible

Check failure on line 249 in packages/apps/src/server/runtime/deno/AppsEngineDenoRuntime.ts

See this annotation in the file changed.

@rc-layne rc-layne / Layne Security Scan

[semgrep] app.config.semgrep.rules.nodejs.child-process-execution 

[R249] Child process execution detected. Ensure command and arguments are not user-controlled.
Command injection (CWE-78) can occur if untrusted input flows into spawn/exec calls.
Remediation:
  - Use allowlists for permitted commands
  - Validate/sanitize all arguments
  - Avoid shell=True or string-based command interpolation
  - Prefer execFile/spawn over exec when possible
View more details on RC - Layne