Skip to content

build(deps): Pin tinypool to patched 2.x to resolve prototype-pollution advisories - #6869

Open
antonis wants to merge 1 commit into
mainfrom
chore/override-tinypool
Open

build(deps): Pin tinypool to patched 2.x to resolve prototype-pollution advisories#6869
antonis wants to merge 1 commit into
mainfrom
chore/override-tinypool

Conversation

@antonis

@antonis antonis commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

📢 Type of change

  • Bugfix
  • New feature
  • Enhancement
  • Refactoring

📜 Description

Adds a resolutions override pinning tinypool to the patched 2.x line (resolves to 2.2.0) to clear two critical prototype-pollution-to-RCE advisories.

tinypool is pinned to exactly 2.1.0 by oxfmt, so a plain lockfile refresh cannot move it — hence the override rather than a yarn up.

Package Before → After Advisory Alert
tinypool 2.1.0 → 2.2.0 Prototype pollution gadget → RCE in run() / worker options #690, #691 (critical)

💡 Motivation and Context

Resolves the two open critical tinypool Dependabot alerts

💚 How did you test it?

  • CI

📝 Checklist

  • I added tests to verify changes.
  • No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
  • I updated the docs if needed.
  • I updated the wizard if needed.
  • All tests passing.
  • Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.
  • No breaking changes.

🔮 Next steps

@antonis @claude
build(deps): Pin tinypool to patched 2.x to resolve prototype-polluti…
b39b6a8 
…on advisories

oxfmt pins tinypool to exactly 2.1.0, so a plain lockfile refresh can't
move it. Add a resolutions override forcing tinypool >= 2.1.2 (resolves
to 2.2.0) to clear the prototype-pollution-to-RCE advisories.

- tinypool: 2.1.0 -> 2.2.0 [#690, #691]

tinypool is a worker-pool library used only by oxfmt (dev/CI formatter);
not shipped in @sentry/react-native. Verified `yarn lint:lerna`
(oxlint + oxfmt) still runs with 2.2.0. The override can be dropped once
oxfmt bumps its own pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

  • build(deps): Pin tinypool to patched 2.x to resolve prototype-pollution advisories by antonis in #6869
  • chore(deps): update JavaScript SDK to v10.76.2 by antonis in #6866
  • ci(core): Guard the "sideEffects": false contract with a lint check by antonis in #6836
  • chore(deps): bump nx from 22.7.7 to 22.7.12 by dependabot in #6857
  • chore(deps): bump compression from 1.7.5 to 1.8.2 by dependabot in #6856
  • chore(deps): bump postcss-selector-parser from 7.1.4 to 7.1.6 by dependabot in #6855
  • chore(deps): bump source-map-js from 1.2.1 to 1.2.2 by dependabot in #6854
  • chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 by dependabot in #6853
  • chore(deps): bump handlebars from 4.7.9 to 4.7.10 by dependabot in #6862
  • chore(deps): update Wizard to v8.0.1 by github-actions in #6852

🤖 This preview updates automatically when you update the PR.

@antonis antonis added the ready-to-merge Triggers the full CI test suite label Oct 12, 2026
@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

iOS (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3849.40 ms 1228.38 ms -2621.02 ms
Size 5.15 MiB 6.95 MiB 1.80 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
d038a14+dirty 3845.71 ms 1228.11 ms -2617.59 ms
1a5721e+dirty 3848.98 ms 1219.59 ms -2629.39 ms
2c735cc+dirty 1229.67 ms 1221.50 ms -8.17 ms
eb93136+dirty 3843.09 ms 1220.11 ms -2622.98 ms
68ae91b+dirty 3834.04 ms 1216.60 ms -2617.44 ms
f170ec3+dirty 3822.26 ms 1218.33 ms -2603.93 ms
ca9d079+dirty 3835.63 ms 1218.68 ms -2616.95 ms
5a21b51+dirty 3823.11 ms 1214.46 ms -2608.65 ms
f3215d3+dirty 3842.73 ms 1219.33 ms -2623.40 ms
faa5ba6+dirty 3859.57 ms 1244.43 ms -2615.15 ms

App size

Revision Plain With Sentry Diff
d038a14+dirty 5.15 MiB 6.67 MiB 1.51 MiB
1a5721e+dirty 4.98 MiB 6.51 MiB 1.53 MiB
2c735cc+dirty 3.38 MiB 4.74 MiB 1.35 MiB
eb93136+dirty 5.15 MiB 6.69 MiB 1.53 MiB
68ae91b+dirty 4.98 MiB 6.46 MiB 1.48 MiB
f170ec3+dirty 5.15 MiB 6.69 MiB 1.53 MiB
ca9d079+dirty 5.15 MiB 6.69 MiB 1.53 MiB
5a21b51+dirty 5.15 MiB 6.67 MiB 1.51 MiB
f3215d3+dirty 5.15 MiB 6.67 MiB 1.52 MiB
faa5ba6+dirty 5.15 MiB 6.95 MiB 1.80 MiB

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Android (legacy) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 428.49 ms 456.70 ms 28.21 ms
Size 50.56 MiB 56.62 MiB 6.06 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
5125c43+dirty 497.18 ms 543.78 ms 46.60 ms
fa21fca+dirty 453.80 ms 468.46 ms 14.66 ms
acd838e+dirty 422.63 ms 462.39 ms 39.76 ms
6acdf1d+dirty 513.58 ms 608.31 ms 94.72 ms
606fb09+dirty 436.49 ms 470.92 ms 34.43 ms
a5d243c+dirty 424.52 ms 485.18 ms 60.66 ms
7ac3378+dirty 404.78 ms 439.84 ms 35.06 ms
4e0b819+dirty 420.56 ms 470.08 ms 49.52 ms
21a1e70+dirty 405.72 ms 436.16 ms 30.44 ms
92aa6d3+dirty 449.12 ms 495.38 ms 46.26 ms

App size

Revision Plain With Sentry Diff
5125c43+dirty 48.30 MiB 53.54 MiB 5.24 MiB
fa21fca+dirty 49.74 MiB 55.37 MiB 5.63 MiB
acd838e+dirty 48.30 MiB 53.60 MiB 5.30 MiB
6acdf1d+dirty 49.74 MiB 55.09 MiB 5.34 MiB
606fb09+dirty 50.56 MiB 56.62 MiB 6.06 MiB
a5d243c+dirty 48.30 MiB 53.54 MiB 5.23 MiB
7ac3378+dirty 43.75 MiB 48.13 MiB 4.37 MiB
4e0b819+dirty 49.74 MiB 54.81 MiB 5.07 MiB
21a1e70+dirty 49.74 MiB 54.82 MiB 5.07 MiB
92aa6d3+dirty 50.56 MiB 56.51 MiB 5.95 MiB

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

Android (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 446.08 ms 466.16 ms 20.08 ms
Size 50.56 MiB 56.62 MiB 6.06 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
04207c4+dirty 395.40 ms 456.55 ms 61.15 ms
0307fa4+dirty 476.48 ms 512.56 ms 36.08 ms
af33f3b+dirty 417.68 ms 448.04 ms 30.37 ms
0a147b2+dirty 442.80 ms 522.24 ms 79.44 ms
606fb09+dirty 493.77 ms 536.16 ms 42.39 ms
44abcc2+dirty 554.18 ms 578.85 ms 24.66 ms
ef27341+dirty 519.02 ms 553.42 ms 34.40 ms
853723c+dirty 415.82 ms 460.94 ms 45.12 ms
083e3ef+dirty 456.74 ms 508.20 ms 51.46 ms
3b6e9f9+dirty 442.39 ms 486.44 ms 44.05 ms

App size

Revision Plain With Sentry Diff
04207c4+dirty 43.94 MiB 48.98 MiB 5.04 MiB
0307fa4+dirty 49.74 MiB 54.81 MiB 5.07 MiB
af33f3b+dirty 49.74 MiB 55.09 MiB 5.35 MiB
0a147b2+dirty 49.74 MiB 55.08 MiB 5.34 MiB
606fb09+dirty 50.56 MiB 56.62 MiB 6.06 MiB
44abcc2+dirty 49.74 MiB 55.36 MiB 5.62 MiB
ef27341+dirty 48.30 MiB 53.54 MiB 5.24 MiB
853723c+dirty 48.30 MiB 53.58 MiB 5.28 MiB
083e3ef+dirty 49.74 MiB 55.36 MiB 5.61 MiB
3b6e9f9+dirty 48.30 MiB 53.54 MiB 5.23 MiB

@github-actions

github-actions Bot commented Oct 12, 2026

Copy link
Copy Markdown
Contributor

iOS (new) Performance metrics 🚀

  Plain With Sentry Diff
Startup time 3883.21 ms 1238.96 ms -2644.25 ms
Size 5.15 MiB 6.95 MiB 1.80 MiB

Baseline results on branch: main

Startup times

Revision Plain With Sentry Diff
b04af96+dirty 3830.54 ms 1206.11 ms -2624.44 ms
0a9e622+dirty 3825.35 ms 1219.04 ms -2606.31 ms
5ca03f9+dirty 3873.76 ms 1236.26 ms -2637.51 ms
09a902f+dirty 3847.65 ms 1221.31 ms -2626.34 ms
64630e5+dirty 3845.49 ms 1215.19 ms -2630.30 ms
68672fc+dirty 3832.22 ms 1228.29 ms -2603.93 ms
7ac3378+dirty 1202.35 ms 1198.31 ms -4.04 ms
ecf47a2+dirty 3844.68 ms 1223.98 ms -2620.70 ms
ab203f9+dirty 3850.11 ms 1213.16 ms -2636.95 ms
5bef5f4+dirty 3858.24 ms 1224.53 ms -2633.71 ms

App size

Revision Plain With Sentry Diff
b04af96+dirty 4.98 MiB 6.54 MiB 1.56 MiB
0a9e622+dirty 4.98 MiB 6.51 MiB 1.53 MiB
5ca03f9+dirty 4.98 MiB 6.53 MiB 1.55 MiB
09a902f+dirty 4.98 MiB 6.46 MiB 1.49 MiB
64630e5+dirty 4.98 MiB 6.46 MiB 1.49 MiB
68672fc+dirty 5.15 MiB 6.71 MiB 1.55 MiB
7ac3378+dirty 3.38 MiB 4.76 MiB 1.38 MiB
ecf47a2+dirty 4.98 MiB 6.46 MiB 1.49 MiB
ab203f9+dirty 4.98 MiB 6.50 MiB 1.52 MiB
5bef5f4+dirty 5.15 MiB 6.89 MiB 1.74 MiB

@antonis
antonis marked this pull request as ready for review October 12, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alwx alwx Awaiting requested review from alwx alwx is a code owner
@lucas-zimerman lucas-zimerman Awaiting requested review from lucas-zimerman lucas-zimerman is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

ready-to-merge Triggers the full CI test suite

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@antonis