CLI accepts an esbuild version outside its declared range, producing corrupt sourcemaps

未关闭
  • 哪里不对？
#4,801 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
48/100
Issue 类型
缺陷
描述清晰度
基本清楚
活跃度
冷清
技术栈
node.js, typescript
领域
backend, build-system

调研方向

Start by tracing the loadConfig → buildWorker build path and the esbuild version resolved under npm overrides; the report compares emitted sourcemaps across esbuild versions. Then read entryPoints/managed-run-worker.js and otel/utils.ts for the stack-handling impact. Done means addressing a clearly chosen safeguard and verifying it against the reported reproduction, including sourcemap index bounds if validation is chosen.

由索引模型根据 Issue 内容生成。

描述

What happened

[email protected] declares esbuild ^0.23.0. Our repo had a root-level npm overrides entry pinning esbuild to 0.25.0, added for GHSA-67mh-4wv8-2f99. npm honours the override, so the CLI bundled with 0.25.0 without warning.

esbuild 0.25.0 has an out-of-bounds source-index regression, fixed in 0.25.1, that drops input sources entries while keeping the mapping indices. Two of our deployed chunks came out internally inconsistent:

  • trigger/slack-attention-agent.mjs.map: 6 sources, mappings referencing index 37
  • a shared ai chunk: 171 sources, mappings referencing index 200

Impact

The worker installs source-map-support globally (entryPoints/managed-run-worker.js). Once a stack contained a frame from either chunk, originalPositionFor threw Error: No element indexed by 6. recordSpanException (otel/utils.ts) and the AI SDK's default error handler (console.error(error)) both read .stack without a guard, so that exception replaced the error being reported.

Every chat.agent turn failed for a week with No element indexed by 6. The original error never surfaced anywhere, including in streamText's onError, which received the substituted message instead. Scheduled tasks on the same deployment kept working, because they never format a stack.

Reproduction

Trigger project on runtime: node-22 with [email protected] and @ai-sdk/[email protected], plus npm overrides: { "esbuild": "0.25.0" }. Build through loadConfig -> buildWorker, then decode each emitted .map and check that every source index is below sources.length:

  • esbuild 0.25.0: 42 of 44 maps valid
  • esbuild 0.23.1: 44 of 44
  • esbuild 0.28.2: 44 of 44

Suggested changes

  1. Warn or fail when the resolved esbuild version falls outside the CLI's declared range. This alone would have surfaced the problem on the first deploy.
  2. Validate emitted sourcemaps before imaging. Checking index bounds is cheap, and the corruption is otherwise invisible until something throws.
  3. Guard .stack access in error reporting so a malformed map cannot replace the error being reported.

Happy to open a PR for 1 or 3.

主要语言
TypeScript
星标
16.5k
派生
1.5k
平均合并
1 天 15 小时
30 天内合并 PR
17

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

triggerdotdev/trigger.dev 的其他 Issue

查看 triggerdotdev/trigger.dev 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。