pezkuwichain/pezkuwi-subquery
1
Fork 0
mirror of https://github.com/pezkuwichain/pezkuwi-subquery.git synced 2026-11-15 19:27:07 +00:00
Code Releases Activity

Lock the indexer image and close the advisories in the build tooling

Browse Source 
The indexer image installed @subql/node and the @polkadot -> @pezkuwi aliases
with an unlocked npm install, and the build cache kept the layer from the day
it was first built: the indexers ran @pezkuwi/wasm-crypto 7.5.17/7.5.18, the
build whose ed25519 and secp256k1 are stubs, plus vm2 3.9.19 (the mapping
sandbox, 54 advisories). No lockfile meant Dependabot never saw that tree.

- docker/indexer holds the image's package.json and package-lock.json:
  @subql/node 6.4.6 as today, @pezkuwi 16.5.39 / 14.0.26 / 7.5.21, overrides
  for vm2 3.12.2, uuid 11 and package-json 7 (got 11). The Dockerfile runs
  npm ci on Node 24 (Node 20 is out of support).
- The pruned-state patch stops the build when a pattern matches nothing,
  instead of reporting success with the fallback missing.
- CI builds the indexer image and runs the crypto smoke test inside it
  through the @polkadot aliases, the way subql-node loads them.
- The root yarn.lock, which the host installs as root on every deploy to run
  subql codegen/build, moves the advisory ranges forward with targeted
  resolutions and @pezkuwi/braces. Left: elliptic (low, via ethers 5 in
  @subql/cli) and sprintf-js (moderate, via jest's argparse 1); neither has
  a fixed release.
This commit is contained in:
Satoshi Qazi Muhammed committed 2026-10-12 17:14:07 +04:00
1 parent 5a92becba0
commit c4f2bd943b
8 files changed
+5557 -305
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docker/Dockerfile.node
+7 -25
View File
@@ -1,31 +1,13 @@
FROM node:20-alpine
FROM node:24-alpine
WORKDIR /app
# Install @subql/node with @polkadot aliased to @pezkuwi
RUN npm init -y && \
npm install @subql/node \
@polkadot/api@npm:@pezkuwi/api@^16.5.36 \
@polkadot/api-augment@npm:@pezkuwi/api-augment@^16.5.36 \
@polkadot/api-derive@npm:@pezkuwi/api-derive@^16.5.36 \
@polkadot/types@npm:@pezkuwi/types@^16.5.36 \
@polkadot/types-augment@npm:@pezkuwi/types-augment@^16.5.36 \
@polkadot/types-codec@npm:@pezkuwi/types-codec@^16.5.36 \
@polkadot/types-create@npm:@pezkuwi/types-create@^16.5.36 \
@polkadot/types-known@npm:@pezkuwi/types-known@^16.5.36 \
@polkadot/rpc-core@npm:@pezkuwi/rpc-core@^16.5.36 \
@polkadot/rpc-provider@npm:@pezkuwi/rpc-provider@^16.5.36 \
@polkadot/rpc-augment@npm:@pezkuwi/rpc-augment@^16.5.36 \
@polkadot/util@npm:@pezkuwi/util@^14.0.25 \
@polkadot/util-crypto@npm:@pezkuwi/util-crypto@^14.0.25 \
@polkadot/keyring@npm:@pezkuwi/keyring@^14.0.25 \
@polkadot/networks@npm:@pezkuwi/networks@^14.0.25 \
@polkadot/wasm-crypto@npm:@pezkuwi/wasm-crypto@^7.5.18 \
@polkadot/wasm-crypto-wasm@npm:@pezkuwi/wasm-crypto-wasm@^7.5.17 \
@polkadot/wasm-util@npm:@pezkuwi/wasm-util@^7.5.17 \
@polkadot/wasm-bridge@npm:@pezkuwi/wasm-bridge@^7.5.17 \
@polkadot/wasm-crypto-asmjs@npm:@pezkuwi/wasm-crypto-asmjs@^7.5.17 \
@polkadot/wasm-crypto-init@npm:@pezkuwi/wasm-crypto-init@^7.5.17
# @subql/node with @polkadot aliased to @pezkuwi. The tree is locked in
# docker/indexer so every build installs the same packages (and Dependabot
# can see them); without the lock a cached layer kept whatever was current
# the day it was first built.
COPY docker/indexer/package.json docker/indexer/package-lock.json ./
RUN npm ci --no-audit --no-fund
# @subql/node requires '@polkadot/api-augment/substrate' but @pezkuwi uses
# chain-specific paths (./pezkuwi, ./bizinikiwi). Patch the exports map in
docker/indexer/package-lock.json
Generated
+5183
View File
File diff suppressed because it is too large. Load diff
docker/indexer/package.json
+35
View File
@@ -0,0 +1,35 @@
{
"name": "subquery-pezkuwi-indexer",
"private": true,
"description": "The indexer image: @subql/node with @polkadot aliased to @pezkuwi, locked so every build installs the same tree.",
"license": "Apache-2.0",
"dependencies": {
"@polkadot/api": "npm:@pezkuwi/api@16.5.39",
"@polkadot/api-augment": "npm:@pezkuwi/api-augment@16.5.39",
"@polkadot/api-derive": "npm:@pezkuwi/api-derive@16.5.39",
"@polkadot/keyring": "npm:@pezkuwi/keyring@14.0.26",
"@polkadot/networks": "npm:@pezkuwi/networks@14.0.26",
"@polkadot/rpc-augment": "npm:@pezkuwi/rpc-augment@16.5.39",
"@polkadot/rpc-core": "npm:@pezkuwi/rpc-core@16.5.39",
"@polkadot/rpc-provider": "npm:@pezkuwi/rpc-provider@16.5.39",
"@polkadot/types": "npm:@pezkuwi/types@16.5.39",
"@polkadot/types-augment": "npm:@pezkuwi/types-augment@16.5.39",
"@polkadot/types-codec": "npm:@pezkuwi/types-codec@16.5.39",
"@polkadot/types-create": "npm:@pezkuwi/types-create@16.5.39",
"@polkadot/types-known": "npm:@pezkuwi/types-known@16.5.39",
"@polkadot/util": "npm:@pezkuwi/util@14.0.26",
"@polkadot/util-crypto": "npm:@pezkuwi/util-crypto@14.0.26",
"@polkadot/wasm-bridge": "npm:@pezkuwi/wasm-bridge@7.5.21",
"@polkadot/wasm-crypto": "npm:@pezkuwi/wasm-crypto@7.5.21",
"@polkadot/wasm-crypto-asmjs": "npm:@pezkuwi/wasm-crypto-asmjs@7.5.21",
"@polkadot/wasm-crypto-init": "npm:@pezkuwi/wasm-crypto-init@7.5.21",
"@polkadot/wasm-crypto-wasm": "npm:@pezkuwi/wasm-crypto-wasm@7.5.21",
"@polkadot/wasm-util": "npm:@pezkuwi/wasm-util@7.5.21",
"@subql/node": "6.4.6"
},
"overrides": {
"package-json": "^7.0.0",
"uuid": "^11.1.1",
"vm2": "3.12.2"
}
}
docker/patches/pruned-state-fallback.js
+16 -6
View File
@@ -13,6 +13,16 @@
const fs = require("fs");
let count = 0;
// A pattern that matches nothing means the patched package changed shape and
// the fallback is gone; stop the image build instead of shipping without it.
function report(label) {
console.log(`${label}: ${count} patches`);
if (count === 0) {
console.error(`${label}: pattern not found`);
process.exit(1);
}
}
// --- Patch 1: @subql/node base-runtime.service.js ---
// getSpecFromApi() and getRuntimeVersion() call
// this.api.rpc.state.getRuntimeVersion(parentBlockHash)
@@ -24,7 +34,7 @@ runtimeCode = runtimeCode.replace(
(m, v) => { count++; return `await this.api.rpc.state.getRuntimeVersion(${v}).catch(() => this.api.rpc.state.getRuntimeVersion())`; }
);
fs.writeFileSync(runtimeFile, runtimeCode);
console.log(`[1/4] base-runtime.service.js: ${count} patches`);
report("[1/4] base-runtime.service.js");
// --- Patch 2: @subql/node utils/substrate.js ---
// fetchRuntimeVersionRange() catches and rethrows; add fallback before rethrow
@@ -37,7 +47,7 @@ utilsCode = utilsCode.replace(
() => { count++; return "api.rpc.state.getRuntimeVersion(hash).catch(() => api.rpc.state.getRuntimeVersion()).catch((e)"; }
);
fs.writeFileSync(utilsFile, utilsCode);
console.log(`[2/4] utils/substrate.js: ${count} patches`);
report("[2/4] utils/substrate.js");
// --- Patch 3: @polkadot/api Init.js ---
// _getBlockRegistryViaHash calls getRuntimeVersion.raw(header.parentHash)
@@ -51,7 +61,7 @@ initCode = initCode.replace(
() => { count++; return "await (0, rxjs_1.firstValueFrom)(this._rpcCore.state.getRuntimeVersion.raw(header.parentHash)).catch(() => (0, rxjs_1.firstValueFrom)(this._rpcCore.state.getRuntimeVersion()))"; }
);
fs.writeFileSync(initFile, initCode);
console.log(`[3/4] @polkadot/api Init.js: ${count} patches`);
report("[3/4] @polkadot/api Init.js");
// --- Patch 4: @subql/node utils/substrate.js (fetchEventsRange) ---
// When events.at(hash) fails with "State already discarded" for pruned blocks,
@@ -64,7 +74,7 @@ utilsCode2 = utilsCode2.replace(
() => { count++; return "api.query.system.events.at(hash).catch((e) => { if (e.message && e.message.includes('State already discarded')) { const empty = []; empty.toArray = () => []; return empty; }"; }
);
fs.writeFileSync(utilsFile, utilsCode2);
console.log(`[4/5] utils/substrate.js fetchEventsRange: ${count} patches`);
report("[4/5] utils/substrate.js fetchEventsRange");
// --- Patch 5: @subql/node utils/substrate.js (wrapExtrinsics / getExtrinsicSuccess) ---
// When events are empty (pruned block), groupEventsByExtrinsic returns {}.
@@ -80,7 +90,7 @@ utilsCode3 = utilsCode3.replace(
() => { count++; return "function getExtrinsicSuccess(events) { if (!events || !events.findIndex) return false;"; }
);
fs.writeFileSync(utilsFile, utilsCode3);
console.log(`[5/7] utils/substrate.js getExtrinsicSuccess: ${count} patches`);
report("[5/7] utils/substrate.js getExtrinsicSuccess");
// --- Patch 6: @subql/node utils/substrate.js (events.toArray fallback) ---
// When events is undefined or has no toArray method, default to empty array.
@@ -91,6 +101,6 @@ utilsCode4 = utilsCode4.replace(
() => { count++; return "const wrappedBlock = wrapBlock(block, (events && events.toArray) ? events.toArray() : [], parentSpecVersion);"; }
);
fs.writeFileSync(utilsFile, utilsCode4);
console.log(`[6/7] utils/substrate.js events.toArray: ${count} patches`);
report("[6/7] utils/substrate.js events.toArray");
console.log("[7/7] All pruned-state patches applied successfully.");