fix(rrweb): null check for pointer by michellewzhang · Pull Request #208 · getsentry/rrweb

michellewzhang · 2024-06-18T20:05:39Z

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

michellewzhang · 2024-06-18T20:05:39Z

fixes JAVASCRIPT-2TN6

ryan953 · 2024-06-18T20:09:01Z

@@ -2179,7 +2179,7 @@ export class Replayer {
 private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
 const pointer = this.pointers[pointerId];


This might be the trick to tell typescript that pointer could be null, then we'll get all the typehints:
Suggested change
constpointer=this.pointers[pointerId];
constpointer=this.pointers.at(pointerId);

that gives me a lint error :(
Unsafe assignment of an `any` value.
eslint@typescript-eslint/no-unsafe-assignment

ooh, think pointers is a Record type, i assumed array without looking.
nbd.

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary - Bumps `markdownlint-cli` from `^0.31.1` to `^0.48.0` - Also bumps `markdownlint` lib from `^0.25.1` to `^0.40.0` to match - Replaces `glob` with `tinyglobby` (no more vulnerable glob dep) - Uses `minimatch@10.2.5` (patched, replaces vulnerable 10.0.3) ## Breaking changes in markdownlint-cli 0.31 -> 0.48 - **Node.js >=20 required** (was >=12) — we use Node 20, not affected - **`glob` replaced by `tinyglobby`** — internal dep swap, CLI interface unchanged, not affected - **`markdownlint` lib 0.25 -> 0.40** — internal engine upgrade, switched to `markdown-it` parser. Some rules renamed/added. We only run `markdownlint docs` with default config, existing warnings are pre-existing, not affected - **New/updated lint rules** — some rules added or tightened across versions. Output now labels findings as "error" instead of bare rule names. Cosmetic only, not affected - **Config format additions** (TOML support added) — our config is unchanged, not affected ## Dependabot alerts resolved - Resolves glob command injection (high) — `glob` removed entirely, replaced by `tinyglobby` - Resolves minimatch ReDoS alerts via `minimatch@10.2.5`: [#213](https://github.com/getsentry/rrweb/security/dependabot/213), [#212](https://github.com/getsentry/rrweb/security/dependabot/212), [#208](https://github.com/getsentry/rrweb/security/dependabot/208), [#201](https://github.com/getsentry/rrweb/security/dependabot/201) - Partially resolves brace-expansion alerts: [#238](https://github.com/getsentry/rrweb/security/dependabot/238), [#134](https://github.com/getsentry/rrweb/security/dependabot/134) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

fix(rrweb): null check for pointer
e0f08ef

michellewzhang requested a review from a teamJune 18, 2024 20:05

ryan953 reviewed Jun 18, 2024
View reviewed changes

ryan953 approved these changes Jun 18, 2024
View reviewed changes

michellewzhang merged commit 011bd05 into sentry-v2Jun 18, 2024

michellewzhang deleted the mz/null-pointer-check branch June 18, 2024 20:18

chargome mentioned this pull request Mar 25, 2026
chore: Replace lerna with lightweight versioning script #272
Merged

chargome mentioned this pull request Apr 16, 2026
fix(deps): bump markdownlint-cli from ^0.31.1 to ^0.48.0 #284
Merged

		@@ -2179,7 +2179,7 @@ export class Replayer {
		private drawMouseTail(position: { x: number; y: number }, pointerId: number) {
		const pointer = this.pointers[pointerId];

	constpointer=this.pointers[pointerId];
	constpointer=this.pointers.at(pointerId);

Uh oh!

Conversation

michellewzhang commented Jun 18, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michellewzhangJun 18, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

michellewzhang commented Jun 18, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michellewzhangJun 18, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

michellewzhang commented Jun 18, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michellewzhangJun 18, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

michellewzhang commented Jun 18, 2024

Uh oh!

Choose a reason for hiding this comment

Uh oh!

michellewzhangJun 18, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

michellewzhangJun 18, 2024•
edited
Loading

michellewzhangJun 18, 2024•
edited
Loading

michellewzhangJun 18, 2024•
edited
Loading

michellewzhangJun 18, 2024•
edited
Loading

michellewzhangJun 18, 2024•
edited
Loading

michellewzhangJun 18, 2024•
edited
Loading