This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new d3c02bbb2cb Harden TypeScript SDK dependency installation (#71394)
d3c02bbb2cb is described below
commit d3c02bbb2cbf0f4b97df6cedd09b82aaba21c98b
Author: Jason(Zhe-You) Liu <[email protected]>
AuthorDate: Tue Aug 11 10:47:58 2026 +0800
Harden TypeScript SDK dependency installation (#71394)
---
ts-sdk/.pre-commit-config.yaml | 1 +
ts-sdk/README.md | 6 ++++++
ts-sdk/pnpm-lock.yaml | 42 ++++++++++++++++++++++++++++++++++++++++++
ts-sdk/pnpm-workspace.yaml | 35 +++++++++++++++++++++++++++++++++++
4 files changed, 84 insertions(+)
diff --git a/ts-sdk/.pre-commit-config.yaml b/ts-sdk/.pre-commit-config.yaml
index 10609453189..26ec8d8d9ce 100644
--- a/ts-sdk/.pre-commit-config.yaml
+++ b/ts-sdk/.pre-commit-config.yaml
@@ -59,6 +59,7 @@ repos:
^src/.*\.ts$|
^package\.json$|
^pnpm-lock\.yaml$|
+ ^pnpm-workspace\.yaml$|
^tsconfig(\.build)?\.json$
additional_dependencies: ['[email protected]']
pass_filenames: false
diff --git a/ts-sdk/README.md b/ts-sdk/README.md
index 2ad2eff9e4e..dfc84b10f91 100644
--- a/ts-sdk/README.md
+++ b/ts-sdk/README.md
@@ -201,6 +201,12 @@ pnpm run typecheck
pnpm run build
```
+The committed lockfile and `pnpm-workspace.yaml` define the dependency security
+policy. Newly released dependency versions must age for 14 days before they
+can enter the lockfile, transitive dependencies cannot use Git or arbitrary
+tarball sources, and only explicitly approved dependencies can run lifecycle
+build scripts. Review changes to both files together when updating
dependencies.
+
Without a local pnpm install, [prek](https://prek.j178.dev) can compile the SDK
with its own managed node + pnpm toolchain:
diff --git a/ts-sdk/pnpm-lock.yaml b/ts-sdk/pnpm-lock.yaml
index 1689afb0eba..7813feb751a 100644
--- a/ts-sdk/pnpm-lock.yaml
+++ b/ts-sdk/pnpm-lock.yaml
@@ -43,8 +43,34 @@ importers:
specifier: ^4.1.7
version:
4.1.7(@types/[email protected])(@vitest/[email protected])([email protected](@types/[email protected])([email protected])([email protected]))
+ example:
+ dependencies:
+ '@apache-airflow/ts-sdk':
+ specifier: file:..
+ version: file:([email protected])
+ devDependencies:
+ '@types/node':
+ specifier: ^22.19.17
+ version: 22.19.17
+ esbuild:
+ specifier: ^0.28.1
+ version: 0.28.1
+ typescript:
+ specifier: ^6.0.2
+ version: 6.0.3
+
packages:
+ '@apache-airflow/ts-sdk@file:':
+ resolution: {directory: '', type: directory}
+ engines: {node: '>=22'}
+ hasBin: true
+ peerDependencies:
+ esbuild: ^0.28.1
+ peerDependenciesMeta:
+ esbuild:
+ optional: true
+
'@apidevtools/[email protected]':
resolution: {integrity:
sha512-60vepv88RwcJtSHrD6MjIL6Ta3SOYbgfnkHb+ppAVK+o9mXprRtulx7VlRl3lN3bbvysAfCS7WMVfhUYemB0IQ==}
engines: {node: '>= 16'}
@@ -511,36 +537,42 @@ packages:
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [arm64]
os: [linux]
+ libc: [glibc]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-b/CgbwAJpmrRLp02RPfhbudf5tZnN9nsPWK82znefso832etkem8H7FSZwxrOI9djcdTP7U6YfNhbRnh7djErg==}
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [arm64]
os: [linux]
+ libc: [musl]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-4EII1iNGRUN5WwGbF/kOh/EIkoDN9HsupgLQoXfY+D1oyJm7/F4t5PYU5n8SWZgG0FEwakyM8pGgwcBYruGTlA==}
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [ppc64]
os: [linux]
+ libc: [glibc]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-AH8oq3XqQo4IibpVXvPeLDI5pzkpYn0WiZAfT05kFzoJ6tQNzwRdDYQ45M8I/gslbodRZwW8uxLhbSBbkv96rA==}
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [s390x]
os: [linux]
+ libc: [glibc]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-cLnjV3xfo7KslbU41Z7z8BH/E1y5mzUYzAqih1d1MDaIGZRCMqTijqLv76/P7fyHuvUcfGsIpqCdddbxLLK9rA==}
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [x64]
os: [linux]
+ libc: [glibc]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-0phclDw1spsL7dUB37sIARuis2tAgomCJXAHZlpt8PXZ4Ba0dRP1e+66lsRqrfhISeN9bEGNjQs+T/Fbd7oYGw==}
engines: {node: ^20.19.0 || >=22.12.0}
cpu: [x64]
os: [linux]
+ libc: [musl]
'@rolldown/[email protected]':
resolution: {integrity:
sha512-0ag/hEgXOwgw4t8QyQvUCxvEg+V0KBcA6YuOx9g0r02MprutRF5dyljgm3EmR02O292UX7UeS6HzWHAl6KgyhA==}
@@ -966,24 +998,28 @@ packages:
engines: {node: '>= 12.0.0'}
cpu: [arm64]
os: [linux]
+ libc: [glibc]
[email protected]:
resolution: {integrity:
sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==}
engines: {node: '>= 12.0.0'}
cpu: [arm64]
os: [linux]
+ libc: [musl]
[email protected]:
resolution: {integrity:
sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==}
engines: {node: '>= 12.0.0'}
cpu: [x64]
os: [linux]
+ libc: [glibc]
[email protected]:
resolution: {integrity:
sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==}
engines: {node: '>= 12.0.0'}
cpu: [x64]
os: [linux]
+ libc: [musl]
[email protected]:
resolution: {integrity:
sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==}
@@ -1279,6 +1315,12 @@ packages:
snapshots:
+ '@apache-airflow/ts-sdk@file:([email protected])':
+ dependencies:
+ '@msgpack/msgpack': 3.1.3
+ optionalDependencies:
+ esbuild: 0.28.1
+
'@apidevtools/[email protected]':
dependencies:
'@jsdevtools/ono': 7.1.3
diff --git a/ts-sdk/pnpm-workspace.yaml b/ts-sdk/pnpm-workspace.yaml
new file mode 100644
index 00000000000..de3dd7361d7
--- /dev/null
+++ b/ts-sdk/pnpm-workspace.yaml
@@ -0,0 +1,35 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+---
+
+packages:
+ - example
+
+# Give the ecosystem time to identify and remove compromised releases before
+# they can enter a newly generated lockfile. Existing locked versions continue
+# to install normally.
+minimumReleaseAge: 20160
+
+# Transitive dependencies must resolve through the configured registry rather
+# than fetching executable content from Git repositories or arbitrary URLs.
+blockExoticSubdeps: true
+
+# pnpm 10 blocks dependency lifecycle scripts by default. Keep that protection
+# explicit and fail when a dependency unexpectedly adds a build script.
+strictDepBuilds: true
+allowBuilds:
+ esbuild: true
