chore: resolve Snyk-reported npm vulnerabilities#244
Merged
Conversation
work-item: ISS-285830 Made-with: Cursor
vpbs2
requested review from
itsTalwar,
ujaval403 and
zaidjan-devrev
as code owners
vpbs2
changed the title
Made-with: Cursor
Replace duckdb glob/tar pin with node-gyp ^11 so the lockfile stays internally consistent under strict npm ci, and add picomatch >=4.0.4. Made-with: Cursor
Made-with: Cursor
|
|
ujaval403
approved these changes
Apr 20, 2026
shriram-devrev
added a commit
that referenced
this pull request
May 8, 2026
semantic-release (dev dep) pins lodash-es@^4.17.21, which npm resolves to 4.17.23 — flagged by Snyk as SNYK-JS-LODASH-15869625 (high) and SNYK-JS-LODASH-15869619 (medium). Latest lodash-es 4.18.1 carries the patches. Adds a root npm override for lodash-es >=4.18.1 so every nested semantic-release dep de-dupes to the patched version. Follows the same pattern as the earlier qs/picomatch/@tootallnate/once overrides from #244. Issues: ISS-279504, ISS-279506
shriram-devrev
added a commit
that referenced
this pull request
May 8, 2026
* fix: qualify struct field access to avoid binder ambiguity post-join When a dimension SQL references a struct field like `stage.stage_id`, the aliaser previously skipped it because `column_names.length !== 1`. After joining tables that have a column with the same name as the struct root (e.g. `devusers.stage` alongside `issue.stage`), DuckDB's binder raises an ambiguous column reference error before the query can run. Make the aliaser schema-aware: introspect each table's physical columns via `DESCRIBE` in the browser and node wrappers, then rewrite a multi-part column ref as `<tableName>.<root>.<rest...>` only when the leading identifier is a known column on the current table. Cross-table references (`customers.id`), already-qualified refs, lambda-bound identifiers, and unknown multi-part refs are left untouched. Falls back to the legacy length-1 behavior when schema information is not supplied, preserving backwards compatibility. * perf: only alias schema members referenced by the query ensureTableSchemasAlias was collecting every measure and dimension across every table schema into a single batch and sending them through ensureColumnAliasBatch — two DuckDB roundtrips (parseExpressions and serializeExpressions) that scale linearly with the number of members in the batch. For tenants with ~8k fields, a single call took ~16.5s even when the active query referenced only a handful of them. Make ensureTableSchemaAliasSql take the Query as a required arg and only alias members the query actually touches — walking measures, dimensions, order, and filters (recursive and/or tree). joinPaths is intentionally excluded: its left/right values are table names, not member references, and the actual join SQL lives in TableSchema.joins[].sql which is already fully qualified. Members not referenced by the query are passed through untouched on the cloned schema, so DuckDB never parses them. For a widget referencing ~20 members out of 8k, that is roughly a 400x reduction in parse/serialize work per call. BREAKING CHANGE: - @devrev/meerkat-core: EnsureTableSchemaAliasSqlParams now requires `query: Query`. - @devrev/meerkat-browser: EnsureTableSchemasAliasParams now requires `query: Query`; the curried ensureTableSchemaAlias(connection) factory returns (tableSchemas, query) => .... - @devrev/meerkat-node: mirrored changes. Bumped meerkat-core, meerkat-browser, meerkat-node to 0.0.128. Unit tests cover query-driven filtering, member preservation for unreferenced members, filter-only refs, order-only refs, and joinPaths exclusion. All pre-existing tests updated to pass a query. Issue: ISS-299745 * chore: override lodash-es to 4.18.1 to clear Snyk advisories semantic-release (dev dep) pins lodash-es@^4.17.21, which npm resolves to 4.17.23 — flagged by Snyk as SNYK-JS-LODASH-15869625 (high) and SNYK-JS-LODASH-15869619 (medium). Latest lodash-es 4.18.1 carries the patches. Adds a root npm override for lodash-es >=4.18.1 so every nested semantic-release dep de-dupes to the patched version. Follows the same pattern as the earlier qs/picomatch/@tootallnate/once overrides from #244. Issues: ISS-279504, ISS-279506 * test(meerkat-node): pass query arg to ensureTableSchemaAliasSql integration tests The two meerkat-node integration tests for ensureTableSchemaAliasSql invoke the core helper directly (rather than through the node wrapper), so they need the new required 'query' arg that drives referenced-member filtering. Reference every fixture member so the aliaser behaves the same as before. Issue: ISS-299745
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolve Snyk-reported npm dependency issues: direct dependency bumps, minimal
overrides(DuckDB/node-gyp, Vitest peers,@tootallnate/once), andmeerkat-dbm/package-lock.jsonso Snyk resolves that package correctly.work-item: ISS-285830
Changes
axios,lodash,next,puppeteer;overridesforduckdb→glob/tar,vitest,@tootallnate/once(removed redundantqsoverride).lodashbump + newpackage-lock.json.Tests
snyk test --all-projects