upstream: merge commits up to 46f1b25 by billyvg · Pull Request #216 · getsentry/rrweb

billyvg · 2024-08-27T21:21:31Z

Merges the following commits:

* Ensure there is separation of timestamps so mutations can be evaluated separately - was failing in the github build process probably due to higher perf * Remove space from test file * Create curvy-balloons-brake.md --------- Co-authored-by: Justin Halsall <Juice10@users.noreply.github.com>

perf(snapshot): avoid costly generation of <a> element on each call to `getHref`, instead cache an anchor element and reuse it's href attributed --------- Co-authored-by: Eoghan Murray <eoghan@getthere.ie>

…later modified (rrweb-io#1467) * Fix that blob urls persist on the shared anchor element and can't be later modified * Create nervous-kiwis-nail.md

Some dev improvements: * Add .editorconfig config file https://editorconfig.org/ * move the singleQuote spec into .editorconfig and add old .changesets/*.md to .prettierignore so that we don't incorrectly reformat new changeset files to single quote from the double quote which they can be autogenerated with in github * .gitignore Ignore emacs chaff files * Add `yarn format:head` a convenience command to run prettier against just those files in the head commit * Some mention of `yarn format` in the docs * Fix some test html closing tags; authoring mistakes, rather than deliberately malformed html — picked up by an explicit `yarn prettier --write '**/*.html'`

* Fix that the `.replace()` function only replaces the first occurrence * This should have been included in rrweb-io#1174 * Create fast-pets-exist.md

This work is to try to provide support where rrweb might be included in applications with various tools that might override Array.from so that the 2nd parameter (the map function) will always work for rrweb. Co-authored-by: Michael Dellanoce <mdellanoce@pendo.io>

* Fix and test for bug rrweb-io#1457 (Uncaught SyntaxError: Regular expression too large) - see test case which is extracted from a real world css file; the selector regex was able to traverse the curly brace as when looking for quotes, it wasn't taking into account that the start quote could be escaped * Apply formatting changes * Create fair-ducks-clean.md * Fix @import regex bit which was stopping consumption in the middle of a url - need to consume quotes. Thanks dave.kindel@pendo.io for reporting and isolating this case --------- Co-authored-by: eoghanmurray <eoghanmurray@users.noreply.github.com>

This work is to try to provide support where rrweb might be included in applications with various tools that might override Array.from so that the 2nd parameter (the map function) will always work for rrweb. Co-authored-by: Michael Dellanoce <mdellanoce@pendo.io>

…update-e96f668c86bd0ab5dc190bb2957a170271bb2ebc

…7a170271bb2ebc

Merges up to commit 46f1b25

…25bd6089cc2e7d34e7c

+ return customHref;
+ }
+ // note: using `new URL` is slower. See #1434 or https://jsbench.me/uqlud17rxo/1
+ a.setAttribute('href', customHref);


Pulls in upstream rrweb commits, see getsentry/rrweb#216

Remove lerna and replace its two uses with lighter alternatives: - **`lerna version`** → `scripts/bump-version.js` — a ~80-line Node script that updates all workspace `package.json` versions and `@sentry-internal/*` cross-references to the exact new version. Modeled after [sentry-javascript#19325](getsentry/sentry-javascript#19325). - **`lerna run build:tarball`** → `turbo run build:tarball` — Turborepo is already used for all other cross-package tasks. Lerna was pulling in a large transitive dependency tree including packages with known vulnerabilities. This removes ~2,300 lines from `yarn.lock`. ### Dependabot alerts resolved **Fully resolved** (vulnerable package completely removed from lockfile): | Alert | Severity | Package | Summary | |-------|----------|---------|---------| | #217 | HIGH | `tar` | Symlink Path Traversal via Drive-Relative Linkpath | | #216 | HIGH | `tar` | Hardlink Path Traversal via Drive-Relative Linkpath | | #185 | HIGH | `tar` | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain | | #176 | HIGH | `tar` | Arbitrary File Creation/Overwrite via Hardlink Path Traversal | | #174 | HIGH | `tar` | Race Condition via Unicode Ligature Collisions on macOS APFS | | #172 | HIGH | `tar` | Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | | #137 | HIGH | `axios` | SSRF and Credential Leakage via Absolute URL | **Partially resolved** (some vulnerable entries removed, but the package still exists via other dependency chains): | Alert | Severity | Package | Remaining source | |-------|----------|---------|-----------------| | #213, #208, #207, #205 | HIGH | `minimatch` | `markdownlint-cli`, `vite-plugin-dts` still pull in vulnerable versions | | #161 | HIGH | `glob` | `markdownlint-cli`, `web-ext-run` still pull in vulnerable versions | | #136, #135 | CRITICAL | `form-data` | `jest` (via jsdom) still pulls in `form-data@3.0.2` | | #158, #157 | MEDIUM | `js-yaml` | `@changesets/cli`, `jest` still pull in `js-yaml@3.14.1` | The partially resolved alerts will be addressed in later phases (Phase 6: mop up remaining — bumping `markdownlint-cli`, `@changesets/cli`, `jest`/rrvideo, etc.). Part of the ongoing effort to resolve all Dependabot alerts on this repo. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

billyvg · 2024-08-27T21:21:31Z