Skip to content

[PLAT-9448] Update to latest spec - #182

Open
jdm717 wants to merge 2 commits into
masterfrom
PLAT-9448/latest-spec
Open

jdm717 wants to merge 2 commits into
masterfrom
PLAT-9448/latest-spec

Conversation

@jdm717

@jdm717 jdm717 commented Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

Summary

Updates to the latest spec, primarily to pull in the addition of scene-item as a valid source for creation of a new scene item.

Other changes included:

  • Updated endpoints for property-key-policies - this removed a few endpoints, but has not been exposed yet in the client, so this shouldn't be an issue
  • Enhanced filtering abilities to support and/or/not along with additional endpoints supporting this filtering
  • Updating a scene-item's parent now supports providing null to reparent to the root of the scene
  • Added definitions for the part-revision-topology-exports - similar to the property key policies, this isn't exposed yet

Note

Medium Risk
Several breaking TypeScript/API renames (property-key-policy keys, file-collection list parameters) and broader filter types may require consumer updates when upgrading from 0.44.0.

Overview
Bumps the package to 0.45.0 and regenerates the OpenAPI client from an updated Vertex API spec.

Scene items: relationships.source can now reference another scene-item (copy from another scene). Update scene item accepts an optional parent relationship, including null to move the item to the scene root.

Filtering: FilterExpression gains and / or / not and a FilterExpressionOrLiteral type. List endpoints add or broaden name filters (filter[name]) on parts, scene-items, and files; file-collections listing switches from CSV filter[suppliedId] to expression-based filters plus filter[name], filter[createdAt], and sort by name or created time.

Property key policies: Entry APIs are replaced by nested keys under /property-key-policies/{id}/keys (list / upsert / delete renamed from *Entries to *Keys). Types split into full PropertyKey resources vs PropertyEntryKey for upsert payloads; old PropertyKeyPolicyEntry* types are removed.

Other API surface: UpdateApplicationRequest adds optional scopes; CreateApplicationRequest uses admin create payload type; pagination on thread participants and scene alterations; getUserGroup typed to return UserGroup; deprecated getQueuedTranslations documented as 301 redirect; queued scene-sync job may redirect when complete. OpenAPI tag part-revision-topology-exports added (not yet wired in generated client beyond spec).

Reviewed by Cursor Bugbot for commit f9bffa8. Bugbot is set up for automated code reviews on this repo. Configure here.

@jdm717
jdm717 requested a review from a team as a code owner September 21, 2026 15:49
@sonarqubecloud

Copy link
Copy Markdown

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit f9bffa8. Configure here.

Comment thread api.ts
}

if (filterCreatedAt !== undefined) {
localVarQueryParameter['filter[createdAt]'] = filterCreatedAt;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Filter expressions stringify as objects

High Severity

FilterExpression query values are assigned as objects to setSearchParams, which stringifies them as [object Object] instead of the documented bracket form such as filter[name][contains]=. listFileCollections also changed filterSuppliedId from a string to FilterExpression, so the previous CSV filter no longer reaches the server correctly, and the new and/or/not operators cannot be sent.

Additional Locations (2)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit f9bffa8. Configure here.

sksizer added a commit that referenced this pull request Oct 9, 2026
| Author | Host | When |
| --- | --- | --- |
| `Agent:(claude-opus-5-5)` | Cursor on SKs-MacBook-Pro.local |
2026-10-08 14:02 CDT |

## Summary

This moves the SDK from axios 1.18.0 to **1.20.0**, clearing the
critical and high axios findings a customer reported against
`@vertexvis/api-client-node` 0.44.0. It also bumps the package to
**0.44.1** so the publish workflow releases it.

- `package.json`: `"axios": "1.20.0"` (still pinned exactly) and version
`0.44.1`.
- `yarn.lock`: only the axios entry and its `form-data ^4.0.6` range
change. `form-data` still resolves to 4.0.6 through the existing
resolution.
- `client/version.ts`: `0.44.1`, synced by `scripts/version.sh` through
`yarn version --no-git-tag-version`. No `v0.44.1` tag was created, so
`detect_publish.sh` will publish on merge.
- `common.ts`: adds `as Promise<R>` on `axios.request`. axios 1.20.0's
types made `tsc` fail here with TS2527 (an inferred type references an
unexported `unique symbol`). The same fix is added to
`scripts/generate.sh` as a post-generation `sed`, alongside the existing
ones, so regenerating the client keeps it. The published declarations
match 0.44.0, apart from axios's own new defaulted fourth type parameter
on `AxiosResponse`.

## Test Plan

- `yarn install --frozen-lockfile`: passed.
- `yarn lint`: passed.
- `yarn verify`: passed. This covers the CJS and ESM builds, jest
(10/10) and `verify.js`.
- `yarn audit --groups dependencies`: before, 12 axios advisories (7
high, 5 moderate, all patched in >=1.20.0); after, 0 vulnerabilities.
- `npm pack`: the tarball is `0.44.1`, and its `package.json` declares
axios 1.20.0.
- Declarations: diffed `dist/cjs/*.d.ts` against the 0.44.0 tarball from
npm. The only change is axios's defaulted type parameter.
- Smoke test against a local mock API, with axios 1.20.0 loaded from
this branch: 41/41 assertions passed.
- Covered: the OAuth client-credentials request (Basic auth and form
body), Bearer and `user-agent: vertex-api-client-node/0.44.1` headers,
`timeout` and a keep-alive `httpAgent` through `axiosOptions`,
`createFile` plus an `application/octet-stream` upload with a
byte-identical body, `getFile`, `deleteFile`, and a 404 surfaced through
the response interceptor.
- Eight broken-server modes all reported FAIL or INCONCLUSIVE rather
than PASS.
- **Not run:** the same smoke script against platdev, because no platdev
API client credentials were available to the agent. It is ready for a
person to run.

## Release Notes

`@vertexvis/api-client-node` 0.44.1 updates its HTTP client dependency,
axios, to 1.20.0, resolving the critical and high security advisories
reported against axios 1.18.0. There are no API changes: upgrade the
dependency and refresh your lockfile.

## Possible Regressions

- axios 1.19 and 1.20 harden how config options are read, how errors for
bad option values are reported, NO_PROXY matching, and keep-alive socket
handling. The SDK uses a plain `axios.create` instance, one response
interceptor, basic and Bearer auth, and octet-stream uploads. None of
these touch the changed behavior; this is inferred from the release
notes and was exercised against the mock.
- The deprecated `CancelToken`, used by queued-job polling, still exists
in 1.20.0.

## Dependencies

-
[vertex-api-client-node#182](#182)
also bumps the package version, to 0.45.0. Whichever lands second has to
rebase. Landing this one first ships the security fix as a patch
release, without the spec changes.

## Related

- [PLAT-9529](https://vertexvis.atlassian.net/browse/PLAT-9529)
- The earlier axios bump:
[vertex-api-client-node#178](#178)


[PLAT-9529]:
https://vertexvis.atlassian.net/browse/PLAT-9529?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Upgrading axios affects all HTTP traffic through the SDK; risk is
moderated by a patch-level dependency bump and a type-only workaround,
but runtime behavior could still shift with axios 1.19–1.20 hardening.
> 
> **Overview**
> Patches **@vertexvis/api-client-node** to **0.44.1** and upgrades the
pinned **axios** dependency from **1.18.0** to **1.20.0**, addressing
reported critical/high advisories on the prior version (lockfile updates
include axios’s **form-data** range).
> 
> axios **1.20.0**’s typings break compilation in
`createRequestFunction` (`common.ts`); the PR adds `as Promise<R>` on
`axios.request` and mirrors that in **`scripts/generate.sh`** so
regenerated clients keep the fix. No public API surface changes beyond
the version bump.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
fb7dc2f. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Cursor <cursoragent@cursor.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants