Pin @hpcc-js/wasm to 2.30.0 to fix webview CSP error#4378
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Pins @hpcc-js/wasm to a pre-new Function() release to avoid violating VS Code webview CSP restrictions introduced by @hpcc-js/wasm@2.31.0, while keeping d3-graphviz functionality working.
Changes:
- Add an npm scoped
overridesentry to forced3-graphvizto use@hpcc-js/wasm@2.30.0. - Update
package-lock.jsonto reflect the overridden dependency graph.
Show a summary per file
| File | Description |
|---|---|
| extensions/ql-vscode/package.json | Adds a scoped npm overrides rule pinning @hpcc-js/wasm under d3-graphviz. |
| extensions/ql-vscode/package-lock.json | Re-locks dependencies so @hpcc-js/wasm@2.30.0 is installed under d3-graphviz rather than at the top level. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Files not reviewed (1)
- extensions/ql-vscode/package-lock.json: Language not supported
- Files reviewed: 1/2 changed files
- Comments generated: 1
@hpcc-js/wasm v2.31.0 introduced a new Function() call in its Emscripten-generated graphviz.js glue code. This violates the webview Content Security Policy, which allows 'wasm-unsafe-eval' but not 'unsafe-eval'. Pin to 2.30.0 (the last version without new Function()) via a scoped npm override on d3-graphviz. Version 2.30.0 still satisfies d3-graphviz's ^2.20.0 requirement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
cklin
force-pushed
the
cklin/hpcc-js-wasm-pin
branch
from
f679b17 to
7491a2b
Compare
nickrolfe
approved these changes
Apr 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@hpcc-js/wasm v2.31.0 introduced a new Function() call in its Emscripten-generated graphviz.js glue code. This violates the webview Content Security Policy, which allows 'wasm-unsafe-eval' but not 'unsafe-eval'.
Pin to 2.30.0 (the last version without
new Function()) via a scoped npm override on d3-graphviz. Version 2.30.0 still satisfies d3-graphviz's ^2.20.0 requirement.