fix(upgrade): Make rename map prototype-safe #7414

jacekradko · 2025-12-09T19:17:13Z

Description

Addressing issue with a codemod producing unexpected output

--- a/src/lib/errors.ts
+++ b/src/lib/errors.ts
@@ -25,7 +25,7 @@ export class AppError extends Error {
    * @param code - Machine-readable error code for categorization
    * @param statusCode - HTTP status code (default: 500)
    */
-  constructor(
+  function Object() { [native code] }(
     message: string,
     public readonly code: string,
     public readonly statusCode: number = 500

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Summary by CodeRabbit

Bug Fixes
- Enhanced security in the upgrade tool to prevent prototype pollution and ensure only intended identifiers are renamed.
Tests
- Added a fixture to ensure constructors are not renamed and made transformer tests use a deterministic fallback when no transform is produced.
Chores
- Released a patch entry documenting the update.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

changeset-bot · 2025-12-09T19:17:17Z

🦋 Changeset detected

Latest commit: 23191c7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/upgrade	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2025-12-09T19:17:18Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
clerk-js-sandbox	Skipped			Dec 9, 2025 7:20pm

coderabbitai · 2025-12-09T19:17:31Z

Walkthrough

Patch release for @clerk/upgrade updates a codemod that aligns experimental/unstable prefixes: mappings are now immutable and renaming is restricted to explicit mappings to avoid prototype pollution. Tests adjusted to ensure no constructor renames and transformer fallback when no output is produced.

Changes

Cohort / File(s)	Summary
Changeset & Release `.changeset/cute-buttons-repair.md`	Declares patch release for `@clerk/upgrade`; documents update to codemod and security note about avoiding prototype pollution.
Codemod Security Enhancement `packages/upgrade/src/codemods/transform-align-experimental-unstable-prefixes.cjs`	Replaced plain mapping with `Object.freeze` immutable `SPECIFIC_RENAMES`; tightened rename logic to only proceed when a mapping exists (uses `Object.hasOwn`); identifier traversal now filters to mapped names before renaming.
Tests & Fixtures `packages/upgrade/src/codemods/__tests__/transform-align-experimental-unstable-prefixes.test.js`, `packages/upgrade/src/codemods/__tests__/__fixtures__/transform-align-experimental-unstable-prefixes.fixtures.js`	Added fixture ensuring class constructors (extending Error) are not renamed; test changed to fallback to trimmed original source when transformer returns falsy (deterministic default).
Manifest `package.json`	Release-related manifest change referenced by changeset (no API signature changes).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Review the new SPECIFIC_RENAMES contents for completeness.
Verify Object.hasOwn checks cover all renaming entry points (imports, exports, JSX attrs, identifiers).
Confirm tests correctly cover constructor edge-case and transformer-falsy fallback behavior.

Poem

A rabbit hops through code at night, 🐇
Freezing names to keep things right,
I guard each rename, one by one,
No prototype trickery — not a single one! ✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(upgrade): Make rename map prototype-safe' directly describes the core fix preventing prototype pollution in the rename mapping logic.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/codemod-prototype-pollution

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between a4c1936 and 23191c7.

📒 Files selected for processing (2)

packages/upgrade/src/codemods/__tests__/__fixtures__/transform-align-experimental-unstable-prefixes.fixtures.js (1 hunks)
packages/upgrade/src/codemods/__tests__/transform-align-experimental-unstable-prefixes.test.js (1 hunks)

🧰 Additional context used

📓 Path-based instructions (8)

**/*.{js,jsx,ts,tsx}