Fix TS builds, Lambda Runtime, Add Array input support, and fix tests by deldrid1 · Pull Request #2 · kdy1/trpc-openapi

deldrid1 · 2024-09-12T20:05:36Z

Hi - I ran into some issues when attempting to use this with @trpc/server v11, and after digging in was impressed anything was working at all given the number of TypeScript issues!

I'm not 100% sure that I have everything exactly right, but tests are passing now and its working for my use case.

… which has peer dependency problems

socket-security · 2024-09-12T20:06:12Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality	Maintenance
	next@13.4.3 ⏵ 13.5.6	^-2	⁺¹
	eslint@8.41.0 ⏵ 8.57.0
	eslint-config-next@13.4.3 ⏵ 13.5.6		⁺¹
	jest@29.5.0 ⏵ 29.7.0			^-3
	@types/uuid@9.0.1 ⏵ 9.0.8
	@typescript-eslint/parser@5.59.7 ⏵ 5.62.0
	@types/swagger-ui-express@4.1.3 ⏵ 4.1.6
	@types/express@4.17.17 ⏵ 4.17.21
	eslint-config-prettier@8.8.0 ⏵ 8.10.0	⁺¹	⁺¹
	@types/jsonwebtoken@9.0.2 ⏵ 9.0.6
	@types/node-fetch@2.6.4 ⏵ 2.6.11	⁺¹
	@types/react-dom@18.2.4 ⏵ 18.3.0	⁺¹	⁺¹
	h3@1.6.6 ⏵ 1.12.0		^-12
	@types/jest@29.5.1 ⏵ 29.5.12
	@types/aws-lambda@8.10.115 ⏵ 8.10.145	⁺¹
	@typescript-eslint/eslint-plugin@5.59.7 ⏵ 5.62.0	⁺¹	⁺¹
	@types/react@18.2.6 ⏵ 18.3.5	⁺¹	⁺¹
	@types/co-body@6.1.0 ⏵ 6.1.3		^-2
	nextjs-cors@2.1.2 ⏵ 2.2.0		⁺¹	⁺²
	@types/swagger-ui-react@4.18.0 ⏵ 4.18.3		^-3
	@types/cors@2.8.13 ⏵ 2.8.17		^-1
	openapi-schema-validator@12.1.1 ⏵ 12.1.3			⁺³
	openapi-types@12.1.1 ⏵ 12.1.3
	node-mocks-http@1.12.2 ⏵ 1.16.0
	jsonwebtoken@9.0.0 ⏵ 9.0.2		⁺¹	^-3
	@types/node@20.2.3 ⏵ 20.16.5
	ts-node@10.9.1 ⏵ 10.9.2
	fastify@4.17.0 ⏵ 4.28.1	⁺¹
	serverless@3.31.0 ⏵ 3.39.0	^-2		⁺⁵
	eslint-plugin-promise@6.1.1 ⏵ 6.6.0
	rimraf@5.0.1 ⏵ 5.0.10
	co-body@6.1.0 ⏵ 6.2.0
	eslint-plugin-import@2.27.5 ⏵ 2.30.0	⁺¹¹
See 16 more rows in the dashboard

View full report

deldrid1 · 2024-09-12T20:15:03Z

I did have to remove the nuxt example due to some peer dependency issues (I think the @next branch of @trpc/client isn't up to date with the fact that trpc-nuxt has a v11 beta which is frustrating...)

socket-security · 2024-09-12T23:37:45Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Critical CVE: npm `fast-xml-parser` has an entity encoding bypass via regex injection in DOCTYPE entity names CVE: GHSA-m7jm-9gc2-mpf2 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names (CRITICAL) Affected versions: >= 5.0.0 < 5.3.5; >= 4.1.3 < 4.5.4 Patched version: 4.5.4 From: package-lock.json → `npm/serverless@3.39.0` → `npm/serverless-offline@12.0.4` → `npm/fast-xml-parser@4.4.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/fast-xml-parser@4.4.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@aws-sdk/client-lambda` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/serverless@3.39.0` → `npm/serverless-offline@12.0.4` → `npm/@aws-sdk/client-lambda@3.650.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@aws-sdk/client-lambda@3.650.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@swagger-api/apidom-parser-adapter-openapi-json-2` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/swagger-ui-react@4.19.1` → `npm/@swagger-api/apidom-parser-adapter-openapi-json-2@1.0.0-alpha.9` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@swagger-api/apidom-parser-adapter-openapi-json-2@1.0.0-alpha.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@ungap/structured-clone` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/eslint@8.57.0` → `npm/@ungap/structured-clone@1.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@ungap/structured-clone@1.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `aws-sdk` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/serverless@3.39.0` → `npm/aws-lambda@1.0.7` → `npm/aws-sdk@2.1691.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/aws-sdk@2.1691.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `axios` is 82.0% likely obfuscated Confidence: 0.82 Location: Package overview From: package-lock.json → `npm/serverless@3.39.0` → `npm/swagger-ui-react@4.19.1` → `npm/axios@1.7.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/axios@1.7.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `css-tree` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/css-tree@3.2.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/css-tree@3.2.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Protestware or unwanted behavior: npm `es5-ext` Note: The script attempts to run a local post-install script, which could potentially contain malicious code. The error handling suggests that it is designed to fail silently, which is a common tactic in malicious scripts. From: package-lock.json → `npm/serverless@3.39.0` → `npm/serverless-offline@12.0.4` → `npm/es5-ext@0.10.64` ℹ Read more on: This package \| This alert \| What is protestware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Consider that consuming this package may come along with functionality unrelated to its primary purpose. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/es5-ext@0.10.64`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `eslint-plugin-react` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/eslint-config-next@13.5.6` → `npm/eslint-plugin-react@7.36.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-react@7.36.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-fetch-native` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/node-fetch-native@1.6.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch-native@1.6.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-forge` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/node-forge@1.4.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-forge@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `powershell-utils` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/powershell-utils@0.1.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/powershell-utils@0.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `rimraf` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/rimraf@5.0.10` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rimraf@5.0.10`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `seroval` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: `?` → `npm/nuxt@3.21.8` → `npm/seroval@1.5.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/seroval@1.5.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

kdy1 · 2024-09-13T02:53:04Z

    "examples/with-interop",
    "examples/with-serverless",
-    "examples/with-fastify",
-    "examples/with-nuxtjs"


Is removal of with-nuxtjs intentional?

with-fastify wasn't, but nuxt was. See the comment up above

Unfortunately, there are some peer dependency issues that prevented me from getting that one going. Rather than have npm install problems, I opted to just take it out here for the time being.

kdy1

Nice work! Thank you!

kdy1 · 2024-09-14T05:06:46Z

-      path: queryPath,
-      procedure,
-    });
+    if(procedure._def.type === "mutation" || procedure._def.type === "query" ){


This seems to exclude subscriptions from the cache. Is it your intention?

Can you add some comments about the intention?

I don't think WebSockets or Server-sent Events (SSE) are being properly handled by openapi-trpc? Happy to revert this if you don't think its a valid change.

kdy1 · 2024-09-14T05:13:11Z

-import type { RootConfig } from '@trpc/server/dist/core/internals/config';
-import { TRPC_ERROR_CODE_KEY } from '@trpc/server/rpc';
-import type { RouterDef } from '@trpc/server/src/core/router';
+import type { APIGatewayProxyEvent, APIGatewayProxyEventV2 } from 'aws-lambda';


I think an import of aws-lambda should be moved to non-shared file.

Its a type import so nothing runtime is affected - its only used during TypeScript builds of the project and is a devDependency. Can you justify the additional complexity of simply not listing it here?

Co-authored-by: Donny/강동윤 <kdy1997.dev@gmail.com>

return an unknown error even if not TRPCError

deldrid1 added 3 commits September 12, 2024 08:16

Fix TypeScript type / build issues and get all tests passing

55ca1e6

Remove extra log, update to latest @trpc, remove examples/with-nuxtjs…

41dc8c0

… which has peer dependency problems

Add prepare step for github install

a99adb4

deldrid1 mentioned this pull request Sep 12, 2024

trpc 11 trpc/trpc-openapi#434

Open

Improve runtime error handling

708065a

kdy1 reviewed Sep 13, 2024

View reviewed changes

kdy1 requested changes Sep 14, 2024

View reviewed changes

deldrid1 and others added 2 commits September 18, 2024 16:33

Update src/adapters/node-http/input.ts

710cf57

Co-authored-by: Donny/강동윤 <kdy1997.dev@gmail.com>

Add native array support

2341b7c

deldrid1 changed the title ~~Fix TS builds, Lambda Runtime, and tests~~ Fix TS builds, Lambda Runtime, Add Array input support, and fix tests Sep 18, 2024

chrisdobler and others added 2 commits September 19, 2024 13:15

return an unknown error even if not TRPCError

05e6342

Merge pull request #1 from chrisdobler/master

d089373

return an unknown error even if not TRPCError

deldrid1 mentioned this pull request Sep 19, 2024

tRPC v11 support trpc/trpc-openapi#455

Open

kdy1 closed this Sep 21, 2024

kdy1 reopened this Sep 21, 2024

refactor: make better-trpc-openapi native to Zod 4

223677e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix TS builds, Lambda Runtime, Add Array input support, and fix tests#2

Fix TS builds, Lambda Runtime, Add Array input support, and fix tests#2
deldrid1 wants to merge 9 commits into
kdy1:masterfrom
deldrid1:master

deldrid1 commented Sep 12, 2024

Uh oh!

socket-security Bot commented Sep 12, 2024 •

edited

Loading

Uh oh!

deldrid1 commented Sep 12, 2024 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 12, 2024 •

edited

Loading

Uh oh!

kdy1 Sep 13, 2024

Uh oh!

deldrid1 Sep 13, 2024 •

edited

Loading

Uh oh!

kdy1 left a comment

Uh oh!

Uh oh!

kdy1 Sep 14, 2024

Uh oh!

kdy1 Sep 14, 2024

Uh oh!

deldrid1 Sep 18, 2024

Uh oh!

kdy1 Sep 14, 2024

Uh oh!

deldrid1 Sep 18, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

deldrid1 commented Sep 12, 2024

Uh oh!

socket-security Bot commented Sep 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deldrid1 commented Sep 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kdy1 Sep 13, 2024

Choose a reason for hiding this comment

Uh oh!

deldrid1 Sep 13, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kdy1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kdy1 Sep 14, 2024

Choose a reason for hiding this comment

Uh oh!

kdy1 Sep 14, 2024

Choose a reason for hiding this comment

Uh oh!

deldrid1 Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

kdy1 Sep 14, 2024

Choose a reason for hiding this comment

Uh oh!

deldrid1 Sep 18, 2024

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

socket-security Bot commented Sep 12, 2024 •

edited

Loading

deldrid1 commented Sep 12, 2024 •

edited

Loading

socket-security Bot commented Sep 12, 2024 •

edited

Loading

deldrid1 Sep 13, 2024 •

edited

Loading