chore: vendor eagle-analytics client 0.1.1 - #935
Merged
Merged
Conversation
Fixes the CodeQL polynomial-redos alert on dist/index.js (trailing-slash trim now scans instead of backtracking).
danieltruong
requested review from
Ckoelewyn,
tolkamps1 and
tom0827
as code owners
September 7, 2026 07:13
The vendored client is the only thing that normalises EAGLE_ANALYTICS_URL, and no spec passed it a trailing slash, so the trim had no covering assertion here. Also notes in VENDOR.md that the Development and Releases sections of the upstream README, and the scripts in package.json, describe the source directory rather than this one.
Adding VENDOR.md changed the directory the file: dependency packs, so the lockfile entry no longer matched and --immutable installs failed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the vendored
@digitalspace/eagle-analytics-clientfrom 0.1.0 to 0.1.1, taken from releaseclient-v0.1.1ofdigitalspace/eagle-analytics.Clears the CodeQL polynomial-redos alert on
vendor/eagle-analytics-client/dist/index.js: the trailing-slash trim onapiUrlwasreplace(/\/+$/, '')and is now a plain scan backwards from the end of the string, so it cannot backtrack.The release assets were checked against the release's
SHA256SUMS(tarball and eachdist/file) before copying.README.mdis the upstream file byte for byte, so the tag and tarball sha256 are recorded in a new siblingVENDOR.mdinstead.Only the vendored directory and the lockfile checksum for the
file:dependency change. Lint, unit tests and the production build pass.