Root yarn.lock, all within existing ranges:
- body-parser 2.4.0 (GHSA high) and qs 6.16.1 via express
- zod 4.6.7 via @modelcontextprotocol/sdk
- fast-uri 3.1.9, serialize-javascript 7.1.3 and ip-address 10.7.4
zod 3.25.76 stays: @subql/cli 6.6.3 (latest) requires ^3.25.67 and fails
to build the project when forced onto zod 4.
docker/indexer: body-parser 2.4.0, qs 6.16.1 and multer 2.5.0. multer is
pinned exactly by @nestjs/platform-express, so it is overridden in scope.
The indexer image installed @subql/node and the @polkadot -> @pezkuwi aliases
with an unlocked npm install, and the build cache kept the layer from the day
it was first built: the indexers ran @pezkuwi/wasm-crypto 7.5.17/7.5.18, the
build whose ed25519 and secp256k1 are stubs, plus vm2 3.9.19 (the mapping
sandbox, 54 advisories). No lockfile meant Dependabot never saw that tree.
- docker/indexer holds the image's package.json and package-lock.json:
@subql/node 6.4.6 as today, @pezkuwi 16.5.39 / 14.0.26 / 7.5.21, overrides
for vm2 3.12.2, uuid 11 and package-json 7 (got 11). The Dockerfile runs
npm ci on Node 24 (Node 20 is out of support).
- The pruned-state patch stops the build when a pattern matches nothing,
instead of reporting success with the fallback missing.
- CI builds the indexer image and runs the crypto smoke test inside it
through the @polkadot aliases, the way subql-node loads them.
- The root yarn.lock, which the host installs as root on every deploy to run
subql codegen/build, moves the advisory ranges forward with targeted
resolutions and @pezkuwi/braces. Left: elliptic (low, via ethers 5 in
@subql/cli) and sprintf-js (moderate, via jest's argparse 1); neither has
a fixed release.
When SubQuery restarts and hits pruned blocks, events are empty (from patch 4).
This caused two downstream crashes:
- getExtrinsicSuccess(undefined) → TypeError on findIndex
- wrapBlock with events.toArray() → TypeError on undefined
Patches 5-6 handle undefined events gracefully.
When SubQuery restarts and the last processed block's state has been
pruned by the RPC node, fetchEventsRange would crash the indexer in a
loop. Now returns empty events for pruned blocks so the indexer can
skip forward gracefully.
The _getBlockRegistryViaHash method in @polkadot/api calls
getRuntimeVersion.raw(header.parentHash) which fails for genesis
and other pruned blocks. Add fallback to current runtime version.
Substrate nodes prune historical state by default (~256 blocks).
When SubQuery restarts and tries to fetch runtime version for old
blocks, it crashes with "State already discarded". This patch adds
a fallback to current runtime version when historical state is
unavailable, preventing crash loops on pruned RPC endpoints.
Also removes --pull from deploy workflow to avoid unnecessary
full rebuilds on every push.
Node.js checks package.json exports before filesystem, so the
mkdir+echo shim didn't work. Now patches the exports map with
node -e to add ./substrate pointing to pezkuwi augmentation.
- Add missing @polkadot/rpc-augment alias to @pezkuwi/rpc-augment
- Create substrate shim for @polkadot/api-augment/substrate that
re-exports @pezkuwi/api-augment's pezkuwi augmentation, fixing
ERR_PACKAGE_PATH_NOT_EXPORTED when @subql/node requires it
Satoshi Qazi Muhammed