Safer autoinstall (#1348)

* set min-release-age

* fix command

* fix tests

* remove typesync (temporarily)

* security updates

* versions

Author: josephjclark

package.json

@@ -18,7 +18,7 @@
     "test:integration": "pnpm -r --filter=./integration-tests/* run test",
     "test:types": "pnpm -r --filter=./packages/* run test:types",
     "test": "pnpm -r --filter=./packages/* run test",
-    "typesync": "pnpm exec typesync && pnpm -r exec typesync && pnpm install"
+    "_typesync": "pnpm exec typesync && pnpm -r exec typesync && pnpm install"
   },
   "keywords": [],
   "author": "Open Function Group",
@@ -34,8 +34,7 @@
     "prettier": "^2.8.8",
     "rimraf": "^6.1.3",
     "semver": "^7.7.4",
-    "tar-stream": "^3.1.8",
-    "typesync": "^0.14.3"
+    "tar-stream": "^3.1.8"
   },
   "packageManager": "pnpm@10.17.1+sha512.17c560fca4867ae9473a3899ad84a88334914f379be46d455cbf92e5cf4b39d34985d452d2583baf19967fa76cb5c17bc9e245529d0b98745721aa7200ecaf7a"
 }

packages/cli/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @openfn/cli
 
+## 1.31.1
+
+### Patch Changes
+
+- 945437c: When installing adaptors, only install versions that have been released for 24hours
+- Updated dependencies [945437c]
+  - @openfn/runtime@1.8.7
+
 ## 1.31.0
 
 ### Minor Changes

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfn/cli",
-  "version": "1.31.0",
+  "version": "1.31.1",
   "description": "CLI devtools for the OpenFn toolchain",
   "engines": {
     "node": ">=18",
@@ -35,6 +35,7 @@
   "devDependencies": {
     "@openfn/language-collections": "^0.8.3",
     "@openfn/language-common": "3.2.3",
+    "@types/lodash-es": "~4.17.12",
     "@types/mock-fs": "^4.13.4",
     "@types/node": "^18.19.130",
     "@types/rimraf": "^3.0.2",

packages/engine-multi/CHANGELOG.md

@@ -1,5 +1,12 @@
 # engine-multi
 
+## 1.10.8
+
+### Patch Changes
+
+- Updated dependencies [945437c]
+  - @openfn/runtime@1.8.7
+
 ## 1.10.7
 
 ### Patch Changes

packages/engine-multi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfn/engine-multi",
-  "version": "1.10.7",
+  "version": "1.10.8",
   "description": "Multi-process runtime engine",
   "main": "dist/index.js",
   "type": "module",

packages/lightning-mock/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @openfn/lightning-mock
 
+## 2.4.10
+
+### Patch Changes
+
+- Updated dependencies [945437c]
+  - @openfn/runtime@1.8.7
+  - @openfn/engine-multi@1.10.8
+
 ## 2.4.9
 
 ### Patch Changes

packages/lightning-mock/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfn/lightning-mock",
-  "version": "2.4.9",
+  "version": "2.4.10",
   "private": true,
   "description": "A mock Lightning server",
   "main": "dist/index.js",
@@ -35,15 +35,13 @@
   },
   "devDependencies": {
     "@types/koa": "^2.15.0",
-    "@types/koa-route": "^3.2.9",
     "@types/koa-websocket": "^5.0.11",
     "@types/koa__router": "^12.0.5",
     "@types/node": "^18.19.130",
     "@types/nodemon": "1.19.3",
     "@types/phoenix": "^1.6.7",
     "@types/yargs": "^17.0.35",
     "ava": "5.3.1",
-    "koa-route": "^3.2.0",
     "koa-websocket": "^7.0.0",
     "query-string": "^8.2.0",
     "tslib": "^2.8.1",

packages/runtime/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @openfn/runtime
 
+## 1.8.7
+
+### Patch Changes
+
+- 945437c: When installing adaptors, only install versions that have been released for 24hours
+
 ## 1.8.6
 
 ### Patch Changes

packages/runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openfn/runtime",
-  "version": "1.8.6",
+  "version": "1.8.7",
   "description": "Job processing runtime.",
   "type": "module",
   "exports": {

packages/runtime/src/modules/repo.ts

@@ -12,6 +12,13 @@ const defaultPkg = {
   dependencies: {},
 };
 
+const npmInstallFlags = [
+  '--no-audit',
+  '--no-fund',
+  '--no-package-lock',
+  `--min-release-age=1`,
+];
+
 export const defaultRepoPath = '/tmp/openfn/repo';
 
 type InstallList = Array<{ name: string; version: string }>;
@@ -60,16 +67,19 @@ export const install = async (
   }
 
   if (forInstalling.length) {
-    const flags = ['--no-audit', '--no-fund', '--no-package-lock'];
     const aliases = forInstalling.map(({ name, version }) => {
       const alias = `npm:${name}@${version}`;
       const aliasedName = `${name}_${version}`;
       return `${aliasedName}@${alias}`;
     });
+    log.info(`npm install ${npmInstallFlags.join(' ')} ${aliases.join(' ')}`);
     // TODO it would be nice to report something about what's going on under the hood here
-    await execFn(`npm install ${flags.join(' ')} ${aliases.join(' ')}`, {
-      cwd: repoPath,
-    });
+    await execFn(
+      `npm install ${npmInstallFlags.join(' ')} ${aliases.join(' ')}`,
+      {
+        cwd: repoPath,
+      }
+    );
     log.success(
       `Installed ${forInstalling
         .map(({ name, version }) => `${name}@${version}`)