mirror of
https://github.com/baptisteArno/typebot.io.git
synced 2026-06-05 21:04:43 +08:00
6f289f647f
## Summary
Fixes 18 open Dependabot alerts and migrates affected code to the new
major versions:
- `@opentelemetry/sdk-node` → `^0.217.0` (Prometheus exporter DoS,
GHSA-q7rr-3cgh-j5r3)
- `nodemailer` → `^8.0.5` across all manifests + root override
(GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8)
- `ai` → `^5.0.52` (GHSA-rwvc-j5jr-mgvh); legacy 3.x dep removed from
`packages/deprecated/legacy` and replaced with a small in-tree
`OpenAIStream` + `StreamingTextResponse` shim
- Provider SDKs aligned to v5 peer: `@ai-sdk/openai`, `anthropic`,
`groq`, `mistral`, `perplexity`, `deepseek`, `togetherai`, `openRouter`,
`dify-ai-provider`
### AI SDK v4 → v5 migration
- `parseTools`: `parameters` renamed to `inputSchema`
- `runChatCompletion` / `runChatCompletionStream`: `maxSteps` replaced
by `stopWhen(stepCountIs(maxSteps))`;
`usage.{prompt,completion,total}Tokens` replaced by
`totalUsage.{input,output,total}Tokens`
- New `toLegacyDataStream` helper that re-emits the v4 data-stream
protocol (`0:text`, `3:error`, `9:tool_call`, …) so existing consumers
in `embeds/js` and the OpenAI `askAssistant` / `askModel` handlers keep
working
- `compatibility: "strict"` removed from `createOpenAI` (option dropped
in v5)
- `formatDataStreamPart` / `processDataStream` imports moved to
`@ai-sdk/ui-utils` (legacy package pinned at 1.2.11)
### E2E test follow-up
Second commit fixes Playwright tests that broke once the env-resolved
URLs / new SDK surface kicked in:
- `fileUpload`: assert exported URL contains `parseS3PublicBaseUrl()`
(not `S3_ENDPOINT`) so it works with `S3_PUBLIC_CUSTOM_DOMAIN`; verify
post-deletion via cache-busted `request.get` instead of a CDN-cached new
tab.
- `ssrf`: assert on the actual "Security validation failed" log emitted
by the pre-flight check; fixture now maps `response.statusCode` into a
`Status` variable so `Status: …` assertions resolve.
- Root `dev` script includes `@typebot.io/partykit` so the webhook
listener e2e test can hit PartyKit on `:1999`.
Also fixes a pre-existing broken anchor link in `whatsapp-ai-agent.mdx`
that blocked the landing-page link checker.
## Test plan
- [ ] `bunx nx test` passes
- [ ] `bunx nx typecheck` passes
- [ ] `bunx nx affected -t
format-and-lint,lint-repo,check-broken-links,test --parallel=4` passes
(pre-commit)
- [ ] `bun run dev` boots builder, viewer, workflows **and** PartyKit
- [ ] Viewer Playwright suite: `fileUpload.spec.ts`, `ssrf.spec.ts`,
`webhookListener.spec.ts` all green
- [ ] Manual smoke: OpenAI `askAssistant` block streams correctly in the
embed (v4 data-stream protocol preserved)
- [ ] Manual smoke: Anthropic / Mistral / Groq blocks still execute
end-to-end
- [ ] Manual smoke: send a test email through a workspace SMTP block
(nodemailer v8)
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
37 lines
1.1 KiB
JSON
37 lines
1.1 KiB
JSON
{
|
|
"name": "@typebot.io/telemetry",
|
|
"version": "0.0.1",
|
|
"type": "module",
|
|
"private": true,
|
|
"exports": {
|
|
"./*": {
|
|
"types": "./src/*.ts",
|
|
"import": "./src/*.ts",
|
|
"default": "./src/*.ts"
|
|
},
|
|
"./package.json": "./package.json"
|
|
},
|
|
"dependencies": {
|
|
"@effect/opentelemetry": "4.0.0-beta.38",
|
|
"@opentelemetry/api": "^1.9.0",
|
|
"@opentelemetry/api-logs": "^0.211.0",
|
|
"@opentelemetry/exporter-logs-otlp-http": "^0.211.0",
|
|
"@opentelemetry/exporter-trace-otlp-http": "^0.217.0",
|
|
"@opentelemetry/resources": "^2.5.0",
|
|
"@opentelemetry/sdk-logs": "^0.211.0",
|
|
"@opentelemetry/sdk-trace-base": "^2.5.0",
|
|
"@opentelemetry/sdk-trace-node": "^2.5.0",
|
|
"@opentelemetry/sdk-trace-web": "^2.5.0",
|
|
"@opentelemetry/semantic-conventions": "^1.39.0",
|
|
"@sentry/bun": "^10.43.0",
|
|
"@typebot.io/env": "workspace:*",
|
|
"@typebot.io/lib": "workspace:*",
|
|
"@typebot.io/prisma": "workspace:*",
|
|
"cookie": "^1.0.2",
|
|
"effect": "4.0.0-beta.38",
|
|
"ky": "^1.2.4",
|
|
"posthog-node": "^5.8.2",
|
|
"zod": "^4.3.5"
|
|
}
|
|
}
|