Repository navigation
Conversation
|
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f9bffa8. Configure here.
| } | ||
|
|
||
| if (filterCreatedAt !== undefined) { | ||
| localVarQueryParameter['filter[createdAt]'] = filterCreatedAt; |
There was a problem hiding this comment.
Filter expressions stringify as objects
High Severity
FilterExpression query values are assigned as objects to setSearchParams, which stringifies them as [object Object] instead of the documented bracket form such as filter[name][contains]=. listFileCollections also changed filterSuppliedId from a string to FilterExpression, so the previous CSV filter no longer reaches the server correctly, and the new and/or/not operators cannot be sent.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit f9bffa8. Configure here.
| Author | Host | When | | --- | --- | --- | | `Agent:(claude-opus-5-5)` | Cursor on SKs-MacBook-Pro.local | 2026-10-08 14:02 CDT | ## Summary This moves the SDK from axios 1.18.0 to **1.20.0**, clearing the critical and high axios findings a customer reported against `@vertexvis/api-client-node` 0.44.0. It also bumps the package to **0.44.1** so the publish workflow releases it. - `package.json`: `"axios": "1.20.0"` (still pinned exactly) and version `0.44.1`. - `yarn.lock`: only the axios entry and its `form-data ^4.0.6` range change. `form-data` still resolves to 4.0.6 through the existing resolution. - `client/version.ts`: `0.44.1`, synced by `scripts/version.sh` through `yarn version --no-git-tag-version`. No `v0.44.1` tag was created, so `detect_publish.sh` will publish on merge. - `common.ts`: adds `as Promise<R>` on `axios.request`. axios 1.20.0's types made `tsc` fail here with TS2527 (an inferred type references an unexported `unique symbol`). The same fix is added to `scripts/generate.sh` as a post-generation `sed`, alongside the existing ones, so regenerating the client keeps it. The published declarations match 0.44.0, apart from axios's own new defaulted fourth type parameter on `AxiosResponse`. ## Test Plan - `yarn install --frozen-lockfile`: passed. - `yarn lint`: passed. - `yarn verify`: passed. This covers the CJS and ESM builds, jest (10/10) and `verify.js`. - `yarn audit --groups dependencies`: before, 12 axios advisories (7 high, 5 moderate, all patched in >=1.20.0); after, 0 vulnerabilities. - `npm pack`: the tarball is `0.44.1`, and its `package.json` declares axios 1.20.0. - Declarations: diffed `dist/cjs/*.d.ts` against the 0.44.0 tarball from npm. The only change is axios's defaulted type parameter. - Smoke test against a local mock API, with axios 1.20.0 loaded from this branch: 41/41 assertions passed. - Covered: the OAuth client-credentials request (Basic auth and form body), Bearer and `user-agent: vertex-api-client-node/0.44.1` headers, `timeout` and a keep-alive `httpAgent` through `axiosOptions`, `createFile` plus an `application/octet-stream` upload with a byte-identical body, `getFile`, `deleteFile`, and a 404 surfaced through the response interceptor. - Eight broken-server modes all reported FAIL or INCONCLUSIVE rather than PASS. - **Not run:** the same smoke script against platdev, because no platdev API client credentials were available to the agent. It is ready for a person to run. ## Release Notes `@vertexvis/api-client-node` 0.44.1 updates its HTTP client dependency, axios, to 1.20.0, resolving the critical and high security advisories reported against axios 1.18.0. There are no API changes: upgrade the dependency and refresh your lockfile. ## Possible Regressions - axios 1.19 and 1.20 harden how config options are read, how errors for bad option values are reported, NO_PROXY matching, and keep-alive socket handling. The SDK uses a plain `axios.create` instance, one response interceptor, basic and Bearer auth, and octet-stream uploads. None of these touch the changed behavior; this is inferred from the release notes and was exercised against the mock. - The deprecated `CancelToken`, used by queued-job polling, still exists in 1.20.0. ## Dependencies - [vertex-api-client-node#182](#182) also bumps the package version, to 0.45.0. Whichever lands second has to rebase. Landing this one first ships the security fix as a patch release, without the spec changes. ## Related - [PLAT-9529](https://vertexvis.atlassian.net/browse/PLAT-9529) - The earlier axios bump: [vertex-api-client-node#178](#178) [PLAT-9529]: https://vertexvis.atlassian.net/browse/PLAT-9529?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Medium Risk** > Upgrading axios affects all HTTP traffic through the SDK; risk is moderated by a patch-level dependency bump and a type-only workaround, but runtime behavior could still shift with axios 1.19–1.20 hardening. > > **Overview** > Patches **@vertexvis/api-client-node** to **0.44.1** and upgrades the pinned **axios** dependency from **1.18.0** to **1.20.0**, addressing reported critical/high advisories on the prior version (lockfile updates include axios’s **form-data** range). > > axios **1.20.0**’s typings break compilation in `createRequestFunction` (`common.ts`); the PR adds `as Promise<R>` on `axios.request` and mirrors that in **`scripts/generate.sh`** so regenerated clients keep the fix. No public API surface changes beyond the version bump. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit fb7dc2f. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> --------- Co-authored-by: Cursor <cursoragent@cursor.com>





Summary
Updates to the latest spec, primarily to pull in the addition of
scene-itemas a valid source for creation of a new scene item.Other changes included:
property-key-policies- this removed a few endpoints, but has not been exposed yet in the client, so this shouldn't be an issueand/or/notalong with additional endpoints supporting this filteringnullto reparent to the root of the scenepart-revision-topology-exports- similar to the property key policies, this isn't exposed yetNote
Medium Risk
Several breaking TypeScript/API renames (property-key-policy keys, file-collection list parameters) and broader filter types may require consumer updates when upgrading from 0.44.0.
Overview
Bumps the package to 0.45.0 and regenerates the OpenAPI client from an updated Vertex API spec.
Scene items:
relationships.sourcecan now reference anotherscene-item(copy from another scene). Update scene item accepts an optionalparentrelationship, includingnullto move the item to the scene root.Filtering:
FilterExpressiongainsand/or/notand aFilterExpressionOrLiteraltype. List endpoints add or broaden name filters (filter[name]) on parts, scene-items, and files; file-collections listing switches from CSVfilter[suppliedId]to expression-based filters plusfilter[name],filter[createdAt], and sort by name or created time.Property key policies: Entry APIs are replaced by nested keys under
/property-key-policies/{id}/keys(list/upsert/deleterenamed from*Entriesto*Keys). Types split into fullPropertyKeyresources vsPropertyEntryKeyfor upsert payloads; oldPropertyKeyPolicyEntry*types are removed.Other API surface:
UpdateApplicationRequestadds optionalscopes;CreateApplicationRequestuses admin create payload type; pagination on thread participants and scene alterations;getUserGrouptyped to returnUserGroup; deprecatedgetQueuedTranslationsdocumented as 301 redirect; queued scene-sync job may redirect when complete. OpenAPI tag part-revision-topology-exports added (not yet wired in generated client beyond spec).Reviewed by Cursor Bugbot for commit f9bffa8. Bugbot is set up for automated code reviews on this repo. Configure here.