DX | 31-08-2026 | Release - #2718
Merged
Merged
Conversation
DX | 12-08-2026 | Release | Back-merge
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
cs-raj
previously approved these changes
Sep 1, 2026
…piry
The oauthRefreshInFlight mutex was assigned via an async IIFE:
this.oauthRefreshInFlight = (async () => { ... })();
In JavaScript the IIFE body executes synchronously before the assignment
completes. The full chain compareOAuthExpiry → refreshToken → initSDK →
managementSDKClient → createAPIClient → compareOAuthExpiry has no await
yields, so the second call sees oauthRefreshInFlight as null and starts
another refresh cycle — leading to unbounded recursion and a RangeError:
Maximum call stack size exceeded.
Fix 1: replace the IIFE assignment with new Promise so the guard is set
synchronously before any nested code can re-enter compareOAuthExpiry.
Fix 2: add skipTokenValidity: true in initSDK so createAPIClient does not
call compareOAuthExpiry again (which would deadlock on the in-flight
promise while that promise is waiting for initSDK to complete).
The outer management client used by commands is created after
compareOAuthExpiry resolves, so it always receives the fresh access token.
Concurrent async callers and the login flow are unaffected.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The 401 branch was recursing with the same stale error and an unincremented counter — allowing unbounded retries. Add the same maxRetryCount guard used by the 429/408 branch: attempt one token refresh, then print a clear error and exit if the 401 persists. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
fix(auth): prevent synchronous re-entrant recursion in compareOAuthExpiry
🔒 Security Scan Results
⏱️ SLA Breach Summary
ℹ️ Vulnerabilities Without Available Fixes (Informational Only)The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:
Consider reviewing these vulnerabilities when fixes become available. |
cs-raj
approved these changes
Sep 2, 2026
reeshika-h
approved these changes
Sep 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.