chore!: stop transpiling webhook integration scripts with Babel

Merged
GG
6mo ago
+88-83

Summary

Remove @babel/core + @babel/preset-env from webhook integration script compilation. Scripts are now stored as-is and executed natively by isolated-vm (V8). Syntax validation at save time uses Node's built-in vm.Script.

Target: 9.0.0 — this is a breaking change for scripts that rely on sloppy-mode behaviors.

Breaking changes to review during upgrade

Class method bodies are always in strict mode per ES2015. The previous Babel transpilation converted class to ES5 function prototypes, which are NOT strict — masking these issues. After this change, scripts must follow strict-mode rules:

1. Implicit globals (HIGH risk)

  class Script {
    process_incoming_request({ request }) {
-     msg = buildMessage(request.content);  // ReferenceError in strict
+     const msg = buildMessage(request.content);
      return { content: { text: msg.text } };
    }
  }

2. this in nested regular functions (HIGH risk)

  class Script {
    process_incoming_request({ request }) {
-     function helper() {
-       return this.JSON.stringify(request);  // this === undefined in strict
-     }
+     const helper = () => {
+       return JSON.stringify(request);  // arrow fn captures outer scope
+     };
      return { content: { text: helper() } };
    }
  }

3. arguments.callee (MEDIUM risk)

  class Script {
    process_incoming_request({ request }) {
-     const factorial = function(n) {
-       return n <= 1 ? 1 : n * arguments.callee(n - 1);  // TypeError
-     };
+     const factorial = function f(n) {
+       return n <= 1 ? 1 : n * f(n - 1);  // named expression
+     };
    }
  }

4. Octal literals (LOW risk)

- const perms = 0777;   // SyntaxError in strict
+ const perms = 0o777;  // ES2015 octal

5. Duplicate parameter names (LOW risk)

- function merge(a, a) { ... }  // SyntaxError in strict
+ function merge(a, b) { ... }

Changes

  • New apps/meteor/app/integrations/server/lib/validateScriptSyntax.ts: wraps new vm.Script(...) from Node's built-in vm module. Syntax errors are surfaced at save time through the existing scriptError field.
  • validateOutgoingIntegration.ts, addIncomingIntegration.ts, updateIncomingIntegration.ts: swap transformSync(@babel/core) for validateScriptSyntax.
  • apps/meteor/package.json: drop @babel/core and @babel/preset-env. @babel/runtime stays (Meteor-compiled packages use it).
  • Fix e2e test incoming-integrations.ts: msg = buildMessage(...) → const msg = buildMessage(...).
  • Changeset marked as major.

Expected image impact

~50 MB reduction (entire @babel/core + @babel/preset-env + plugin-transform-* + helper-* + traverse + generator tree removed from programs/server/npm/node_modules/).

Upgrade recommendation

Admins should review existing webhook scripts (Admin → Integrations) before upgrading to 9.0.0. Any script using class Script { ... } that contains the patterns above needs to be updated. The webhook editor could show a warning banner during the 8.x→9.0 transition period.

Test plan

  • TypeScript / lint pass.
  • POST /integrations.create → should return scriptCompiled and no scriptError passes.
  • POST /hooks/:id/:token with proper const declarations: returns 200.
  • Integration with deliberate syntax error: scriptError populated, no scriptCompiled.
  • Existing integrations continue to run (their scriptCompiled is older Babel output — valid JS that V8 runs unchanged).

Task: ARCH-2101

Summary by CodeRabbit

  • Chores

    • Removed Babel transpilation from integration script processing; scripts now execute directly in isolated VM environments requiring ES2015+ compliance.

  • Documentation

    • Added changelog entry documenting integration script handling update and stricter semantic behavior.

  • Tests

    • Updated integration script tests to reflect new execution semantics.

Task: [DOCS-1379]