[Snyk] Fix for 3 vulnerabilities - #17
Open
agha4to wants to merge 1 commit into
Open
Conversation
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-OCTOKITPLUGINPAGINATEREST-8730855 - https://snyk.io/vuln/SNYK-JS-OCTOKITREQUEST-8730853 - https://snyk.io/vuln/SNYK-JS-OCTOKITREQUESTERROR-8730854
agha4to
pushed a commit
that referenced
this pull request
Jun 17, 2026
…H-452) (lightdash#24251) * feat(common): cast day-or-coarser DATE_TRUNCs to DATE in getSqlForTruncatedDate Adds an opt-in castDayGrainToDate param: day-or-coarser truncations cast the project-wall-clock value to DATE (dropping the toUTC round-trip-back); sub-day grains stay TIMESTAMP. Dormant until the query builder passes the flag (behind EnableTimezoneSupport). Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(backend): wire day-or-coarser DATE cast through MetricQueryBuilder getTimezoneAwareDimensionSql passes castDayGrainToDate=true to getSqlForTruncatedDate (reached only when useTimezoneAwareDateTrunc is on), so day-or-coarser SELECT and WHERE-LHS expressions emit CAST(... AS DATE). Adds a MetricQueryBuilder integration test. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(common): emit bare date literals for day-grain filters Day-or-coarser dims now compile to a real DATE LHS (CAST(... AS DATE)), so their filter literals and relative-filter boundaries stay bare across warehouses — wrapping them as timestamptz would re-introduce the tz drift the cast removes. Updates the filter-literal-wrapping test suite to the new bare contract; adds a MetricQueryBuilder integration test. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(common): collapse calendar-value predicates so day-grain DATE no longer shifts isCalendarValueDimension is now true for any DATE-typed field and shouldShiftItemTimezone false for them, since day-or-coarser truncs compile to a real DATE (the single update point GLITCH-450 consolidated). formatItemValue, spreadsheet exports, drill-filter normalization and the ECharts category-date axis all stop shifting day-grain DATE values — fixing the negative-offset off-by-one. Tests updated to the no-shift contract. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(common): emit YYYY-MM-DD raw values for DATE fields in tz-aware mode formatRawValue gains an optional timezone param: when a display timezone is resolved (tz-aware mode on), DATE fields emit a bare YYYY-MM-DD raw matching the warehouse type; undefined keeps the legacy ISO output (byte-identical, flag-off). Threaded via the timezone formatRow already passes, plus formatRawRows for subtotals (resolving the gated displayTimezone once) and the pivot-values path. The value is never shifted — the tz is only a mode signal. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(timezones): split MIN/MAX out of GLITCH-452 to GLITCH-499 The design doc's MIN/MAX section described the wrong failure mode (a date-string fall-through). The real issue: MAX/MIN over a DATE value is tz-shifted because the formatter branch catches both the JS Date and the ISO-midnight string and shifts them. Fixing it needs a metric-level type signal, which is out of scope for 452 — split to GLITCH-499 and corrected the analysis in the Scope list and §3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(timezones): update timezone-handling.md for the GLITCH-452 DATE cast Day-or-coarser TIMESTAMP-base truncations now compile to a real DATE (CAST of the truncated wall-clock), so the engineer-facing reference is updated across: SELECT grouping (per-grain output type), filter parity + bare-date literals, result formatting + the removed correction layer, the raw wire value, cell-actions (normalizeCellRawForFilter is now an inert no-op since the predicate collapse), the ECharts shift scope, and the overview/vision diagrams. Sub-day grains still return a UTC instant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(common): cast day-grain to DATE via DATE(expr, tz) on BigQuery BigQuery's TIMESTAMP_TRUNC returns the tz-midnight value as a UTC instant, so CAST(... AS DATE) read its UTC date and bucketed day-or-coarser grains a day early in positive-offset project timezones (Europe/Asia/Australia). Use DATE(expr, tz) on BigQuery to read the calendar date in the project tz; other adapters truncate to wall-clock, so CAST AS DATE stays correct there. Found via cross-warehouse execution testing: Asia/Tokyo bucketed a 15:00Z row to the previous day on BigQuery, while Snowflake/Databricks/Trino were correct. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(timezones): update GLITCH-452 design doc with implementation outcomes Status → implemented/in-review; add an "Implementation status & outcomes" section (BigQuery DATE(expr,tz) per-adapter fix, 6/6 cross-warehouse pass, downstream surface validated, normalizeCellRawForFilter now inert). Resolve the §1 "decision to confirm" lines (date-zoom not cast → GLITCH-505; per-adapter cast required + verified) and mark the §5 tests, risks, and docs-to-update items done. Follow-ups: GLITCH-499 / GLITCH-503 / GLITCH-505. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(timezones): record downstream blast-radius audit in GLITCH-452 design doc Audit verdicts (all flag-gated): custom dimensions, conditional formatting, result caching, saved filters, underlying-data/drill, sorting & totals all inert. One genuine breaking case — raw-SQL table calcs with TIMESTAMP-specific ops on truncated date dims (GLITCH-506). Latent/pre-existing noted: MIN/MAX-on- date in CF (GLITCH-499) and the PoP range pre-filter coercion (GLITCH-505). Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(common): align createFilterRuleFromField date tests with the predicate collapse GLITCH-452 makes day-or-coarser TIMESTAMP-base truncs compile to a real DATE, so they are calendar values and the drill/filter path no longer shifts them. Update the stale lightdash#22895 tests (which fed the old UTC-instant representation and expected a project-tz shift) to the post-452 model: bare cast dates are not shifted, and a legacy UTC-instant value is read at UTC. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(backend): DATE-base-TS Excel cells are not shifted post-cast (GLITCH-452) The predicate collapse makes day-or-coarser TIMESTAMP-base truncs real DATEs (calendar values), so convertRowToExcel no longer shifts them. Update the stale test that fed the old UTC-instant and expected a project-tz shift: feed the bare cast date and assert no shift, matching the native-DATE case. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(api-tests): add timezone boundary-crossing battery (GLITCH-452) Adds day/month/year/DST boundary-crossing tests over the timezone_test boundary rows (11-18) at offsets that flip a boundary — year (#17 → 2023 in NY), month (#18 → Feb in Tokyo/Kiritimati+14), Tokyo-midnight day (#11), fractional St_Johns (-3:30), and US spring/fall DST days. Asserts the bare-date raw bucket to rule out double conversions. Verified 12/12 against a flag-enabled backend. Adds an eventIds scope + getRawBucketMap helper to support boundary-row queries. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(frontend): DATE-base-TS day buckets are not axis-shifted post-cast (GLITCH-452) After merging main, resolveAxisTimezone (which gates on shouldShiftItemTimezone) no longer shifts a DATE day bucket derived from a TIMESTAMP base — the cast makes it a real DATE calendar value. Flip main's stale test to expect no shift, matching the native-DATE case. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(backend): DATE-base-TS CSV cells are not shifted post-cast (GLITCH-452) Last of the stale correction-layer tests: a day-or-coarser TIMESTAMP-base trunc is now a real DATE (calendar value), so convertRowToCsv does not shift it. Flip the expectation to no-shift, matching the native-DATE case. Verified against the full backend/common/frontend suites — no remaining stale tests. Relates: GLITCH-452 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
agha4to
pushed a commit
that referenced
this pull request
Jun 17, 2026
# [0.3174.0](lightdash/lightdash@0.3173.0...0.3174.0) (2026-06-16) ### Features * **timezone:** cast day-or-coarser DATE_TRUNCs to a real DATE (GLITCH-452) ([lightdash#24251](lightdash#24251)) ([e149743](lightdash@e149743)), closes [lightdash#22895](lightdash#22895) [#17](lightdash#17) [#18](lightdash#18) [#11](lightdash#11)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to fix 3 vulnerabilities in the yarn dependencies of this project.
Snyk changed the following file(s):
packages/backend/package.jsonNote for zero-installs users
If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the
.yarn/cache/directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to runyarnto update the contents of the./yarn/cachedirectory.If you are not using zero-install you can ignore this as your flow should likely be unchanged.
Vulnerabilities that will be fixed with an upgrade:
SNYK-JS-OCTOKITPLUGINPAGINATEREST-8730855
SNYK-JS-OCTOKITREQUEST-8730853
SNYK-JS-OCTOKITREQUESTERROR-8730854
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Regular Expression Denial of Service (ReDoS)