Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ target
*.swp
.pnpm-store

# Claude Code session files
.claude/

#All generated code for scenarios
scenarios/**/*.bs.js
scenarios/**/*.res.js
Expand Down
1 change: 1 addition & 0 deletions codegenerator/Cargo.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions codegenerator/cli/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@ dotenvy = { git = "https://github.com/enviodev/dotenvy", rev = "e2da110668572cf2

[dev-dependencies]
tempdir = "0.3"
tempfile = "3.14"

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

tempfile crate latest version crates.io

💡 Result:

The latest published version of the tempfile crate is 3.24.0. (docs.rs)

Citations:


🌐 Web query:

tempfile rust crate security advisory vulnerability

💡 Result:

Short answer: There is no widely‑reported, active security advisory for the maintained tempfile crate itself. The historical advisories you should know about are:

  • tempdir was deprecated and merged into tempfile (RUSTSEC-2018-0017). [1]
  • The unrelated temporary crate had an uninitialized‑memory RNG issue (GHSA-2jq9-6xx7-3h29 / fixed in temporary 0.6.4); users are advised to use tempfile for general-purpose temporary files. [2][3]
  • Some dependencies used by tempfile (e.g., remove_dir_all) have had TOCTOU/race advisories in the ecosystem; check tempfile’s dependency versions and upstream advisories. [4]

Recommendations:

  • Pin and upgrade to the latest tempfile release (check crates.io) and audit its dependency versions.
  • Monitor RustSec / OSV / GitHub Advisory Database and the tempfile crate changelog for new advisories. [1][3]

Sources:

  1. RustSec advisory for tempdir (deprecation). [rustsec.org / OSV]. [1]
  2. GitHub/GHSA advisory for temporary (uninitialized memory) — fixed in 0.6.4. [2]
  3. OSV / GitHub advisory import (GHSA RUSTSEC references). [3]
  4. deps.rs page for tempfile (shows dependency advisories such as remove_dir_all). [4]

If you want, I can check the current latest tempfile version and any advisories right now.


Upgrade tempfile to version 3.24.0 or later.

Version 3.14 is significantly outdated; the latest stable version is 3.24.0. While there are no active security advisories for tempfile 3.14 itself, upgrading captures ten minor versions of bug fixes and improvements. Review the changelog for any breaking changes before upgrading.

🤖 Prompt for AI Agents
In @codegenerator/cli/Cargo.toml around line 50, Update the tempfile dependency
version string in Cargo.toml from "3.14" to "3.24.0" (or later); locate the
dependency entry 'tempfile = "3.14"' and change the version specifier, then run
cargo update / cargo build to ensure compatibility and review the tempfile
changelog for any required code changes.

paste = "1.0.12"
tracing-subscriber = "0.3.17"
pretty_assertions = "1.4.0"
Expand Down
4 changes: 4 additions & 0 deletions codegenerator/cli/CommandLineHelp.md
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,10 @@ Initialize an indexer with one of the initialization options
Possible values: `typescript`, `rescript`

* `--api-token <API_TOKEN>` — The hypersync API key to be initialized in your templates .env file
* `-p`, `--package-manager <PACKAGE_MANAGER>` — The package manager to use (npm, yarn, pnpm, bun). Auto-detected from lockfiles if not specified

Possible values: `npm`, `yarn`, `pnpm`, `bun`




Expand Down
21 changes: 21 additions & 0 deletions codegenerator/cli/npm/envio/evm.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,17 @@
"format": "uint64",
"minimum": 0
},
"package_manager": {
"description": "Package manager to use: npm, yarn, pnpm, or bun. If not specified, auto-detected from lockfiles in the project directory.",
"anyOf": [
{
"$ref": "#/$defs/PackageManager"
},
{
"type": "null"
}
]
},
"ecosystem": {
"description": "Ecosystem of the project.",
"anyOf": [
Expand Down Expand Up @@ -145,6 +156,16 @@
"chains"
],
"$defs": {
"PackageManager": {
"description": "Supported package managers",
"type": "string",
"enum": [
"npm",
"yarn",
"pnpm",
"bun"
]
},
"EcosystemTag": {
"type": "string",
"enum": [
Expand Down
21 changes: 21 additions & 0 deletions codegenerator/cli/npm/envio/fuel.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,17 @@
"format": "uint64",
"minimum": 0
},
"package_manager": {
"description": "Package manager to use: npm, yarn, pnpm, or bun. If not specified, auto-detected from lockfiles in the project directory.",
"anyOf": [
{
"$ref": "#/$defs/PackageManager"
},
{
"type": "null"
}
]
},
"ecosystem": {
"description": "Ecosystem of the project.",
"$ref": "#/$defs/EcosystemTag"
Expand Down Expand Up @@ -81,6 +92,16 @@
"chains"
],
"$defs": {
"PackageManager": {
"description": "Supported package managers",
"type": "string",
"enum": [
"npm",
"yarn",
"pnpm",
"bun"
]
},
"EcosystemTag": {
"type": "string",
"enum": [
Expand Down
22 changes: 21 additions & 1 deletion codegenerator/cli/npm/envio/svm.schema.json
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,17 @@
"format": "uint64",
"minimum": 0
},
"package_manager": {
"description": "Package manager to use: npm, yarn, pnpm, or bun. If not specified, auto-detected from lockfiles in the project directory.",
"anyOf": [
{
"$ref": "#/$defs/PackageManager"
},
{
"type": "null"
}
]
},
"ecosystem": {
"description": "Ecosystem of the project.",
"$ref": "#/$defs/EcosystemTag"
Expand All @@ -64,6 +75,16 @@
"chains"
],
"$defs": {
"PackageManager": {
"description": "Supported package managers",
"type": "string",
"enum": [
"npm",
"yarn",
"pnpm",
"bun"
]
},
"EcosystemTag": {
"type": "string",
"enum": [
Expand Down Expand Up @@ -101,4 +122,3 @@
}
}
}

6 changes: 6 additions & 0 deletions codegenerator/cli/src/cli_args/clap_definitions.rs
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
use crate::constants::project_paths::{DEFAULT_CONFIG_PATH, DEFAULT_GENERATED_PATH};
use crate::package_manager::PackageManager;

use clap::{Args, Parser, Subcommand};
use clap_markdown::MarkdownOptions;
Expand Down Expand Up @@ -145,6 +146,11 @@ pub struct InitArgs {
///The hypersync API key to be initialized in your templates .env file
#[arg(global = true, long)]
pub api_token: Option<String>,

///The package manager to use (npm, yarn, pnpm, bun). Auto-detected from lockfiles if not specified.
#[arg(global = true, short = 'p', long = "package-manager")]
#[clap(value_enum)]
pub package_manager: Option<PackageManager>,
}

#[subenum(EvmInitFlowInteractive)]
Expand Down
3 changes: 3 additions & 0 deletions codegenerator/cli/src/cli_args/init_config.rs
Original file line number Diff line number Diff line change
Expand Up @@ -164,6 +164,7 @@ pub mod evm {
output: None,
handlers: None,
full_batch_size: None,
package_manager: init_config.package_manager,
},
ecosystem: None,
contracts,
Expand Down Expand Up @@ -306,6 +307,7 @@ pub mod fuel {
output: None,
handlers: None,
full_batch_size: None,
package_manager: init_config.package_manager,
},
ecosystem: EcosystemTag::Fuel,
contracts: None,
Expand Down Expand Up @@ -374,4 +376,5 @@ pub struct InitConfig {
pub ecosystem: Ecosystem,
pub language: Language,
pub api_token: Option<String>,
pub package_manager: Option<crate::package_manager::PackageManager>,
}
1 change: 1 addition & 0 deletions codegenerator/cli/src/cli_args/interactive_init/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -189,5 +189,6 @@ pub async fn prompt_missing_init_args(
ecosystem,
language,
api_token,
package_manager: init_args.package_manager,
})
}
Loading