CLI accepts an esbuild version outside its declared range, producing corrupt sourcemaps

Aperta
  • Qualcosa non va?
#4,801 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
node.js, typescript
Ambito
backend, build-system

Direzione di ricerca

Start by tracing the loadConfig → buildWorker build path and the esbuild version resolved under npm overrides; the report compares emitted sourcemaps across esbuild versions. Then read entryPoints/managed-run-worker.js and otel/utils.ts for the stack-handling impact. Done means addressing a clearly chosen safeguard and verifying it against the reported reproduction, including sourcemap index bounds if validation is chosen.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

What happened

[email protected] declares esbuild ^0.23.0. Our repo had a root-level npm overrides entry pinning esbuild to 0.25.0, added for GHSA-67mh-4wv8-2f99. npm honours the override, so the CLI bundled with 0.25.0 without warning.

esbuild 0.25.0 has an out-of-bounds source-index regression, fixed in 0.25.1, that drops input sources entries while keeping the mapping indices. Two of our deployed chunks came out internally inconsistent:

  • trigger/slack-attention-agent.mjs.map: 6 sources, mappings referencing index 37
  • a shared ai chunk: 171 sources, mappings referencing index 200

Impact

The worker installs source-map-support globally (entryPoints/managed-run-worker.js). Once a stack contained a frame from either chunk, originalPositionFor threw Error: No element indexed by 6. recordSpanException (otel/utils.ts) and the AI SDK's default error handler (console.error(error)) both read .stack without a guard, so that exception replaced the error being reported.

Every chat.agent turn failed for a week with No element indexed by 6. The original error never surfaced anywhere, including in streamText's onError, which received the substituted message instead. Scheduled tasks on the same deployment kept working, because they never format a stack.

Reproduction

Trigger project on runtime: node-22 with [email protected] and @ai-sdk/[email protected], plus npm overrides: { "esbuild": "0.25.0" }. Build through loadConfig -> buildWorker, then decode each emitted .map and check that every source index is below sources.length:

  • esbuild 0.25.0: 42 of 44 maps valid
  • esbuild 0.23.1: 44 of 44
  • esbuild 0.28.2: 44 of 44

Suggested changes

  1. Warn or fail when the resolved esbuild version falls outside the CLI's declared range. This alone would have surfaced the problem on the first deploy.
  2. Validate emitted sourcemaps before imaging. Checking index bounds is cheap, and the corruption is otherwise invisible until something throws.
  3. Guard .stack access in error reporting so a malformed map cannot replace the error being reported.

Happy to open a PR for 1 or 3.

Lingua principale
TypeScript
Stelle
16.5k
Fork
1.5k
Merge medio
1g 15h
PR unite (30g)
17

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di triggerdotdev/trigger.dev

Tutte le issue di triggerdotdev/trigger.dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.