fix(amplify-category-function): remove jstreemap dependency#14939
Draft
sarayev wants to merge 1 commit into
Draft
fix(amplify-category-function): remove jstreemap dependency#14939sarayev wants to merge 1 commit into
sarayev wants to merge 1 commit into
Conversation
jstreemap releases 1.29.1-1.29.3 shipped a broken UMD bundle that threw "ReferenceError: self is not defined" on Node, crashing amplify-category-function during `amplify init` and causing SEV-2s. PR #14922 mitigated this by pinning jstreemap to 1.28.2, but the risk vector remained. The package only used jstreemap's TreeSet, and solely for membership checks and a single max-value lookup. These are trivially served by the native Set: all `new TreeSet()` instances become `new Set<number>()`, the `TreeSet<number>` type annotations become `Set<number>`, and the one `daysOfMonth.last()` call becomes `Math.max(...this.daysOfMonth)`. Removing the dependency entirely permanently eliminates the broken-bundle risk. Removed the `jstreemap` entry from the package manifest and regenerated yarn.lock to drop all jstreemap entries. Testing: tsc clean, cron expression tests 7/7 passing, and zero remaining jstreemap/TreeSet references across the package. --- Prompt: Can we get rid of jstreemap in our repo (amplify-cli) completely? Implement that! Prepare a PR for it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
Removes the
jstreemapdependency fromamplify-category-functionentirely.jstreemap releases 1.29.1–1.29.3 shipped a broken UMD bundle that threw
ReferenceError: self is not definedon Node, crashingamplify-category-functionduringamplify initand causing SEV-2s. PR #14922 mitigated this by pinning jstreemap to1.28.2, but the dependency — and therefore the risk vector — remained.The package only used jstreemap's
TreeSet, and only for membership checks and a single max-value lookup. These are trivially served by the nativeSet, so the dependency can be dropped outright rather than pinned, permanently eliminating the broken-bundle risk.Replace TreeSet with native Set
In the cron expression generator, all
TreeSetusage is migrated toSet<number>: the field initializers and reset paths now constructnew Set<number>(), theTreeSet<number>type annotations becomeSet<number>, and the one sorted-order lookup (daysOfMonth.last()) becomesMath.max(...this.daysOfMonth), which returns the same largest element. Membership checks (.has()) and insertions (.add()) are identical on both types, so behavior is unchanged.Drop the dependency
The
jstreemapentry is removed from the package manifest andyarn.lockis regenerated to drop all related entries.Issue #, if available
N/A — follow-up to the mitigation in #14922.
Description of how you validated changes
tsctype-checks cleanly with no errors.scheduleWalkthrough) passes 7/7.jstreemap/TreeSetreferences across the package, and zerojstreemapentries inyarn.lock.Checklist
yarn testpassesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.