TD-8001: Bump @jupiterone/query-language-parser to ^6.3.20 - #146
TD-8001: Bump @jupiterone/query-language-parser to ^6.3.20#146jmountifield wants to merge 2 commits into
Conversation
Update @jupiterone/query-language-parser to ^6.3.20 to support the 'scalars in subqueries' feature. Resolves: https://jupiterone.atlassian.net/browse/TD-8001
CI Failure AnalysisValidation script fails: rule Root cause: Parser v6.3.18 (TD-7817) added RETURN/ORDER BY selector identifier validation. The rule's query uses Fix needed: Update the rule's J1QL query to use a valid identifier (likely needs an alias or correct selector reference). |
Change cm,displayName (comma) to cm.displayName (dot) in the RETURN clause. The comma was causing the parser to interpret 'displayName' as a separate invalid selector identifier.
There was a problem hiding this comment.
Pull request overview
Updates the query parser dependency to support scalar function returns in subqueries, and adjusts an SBOM rule-pack query to correct its RETURN field syntax.
Changes:
- Bump
@jupiterone/query-language-parserfrom^4.5.0to^6.3.20 - Fix the SBOM rule-pack query RETURN clause from
cm,displayNametocm.displayName
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| rule-packs/jupiterone-sbom.json | Fixes a malformed RETURN field reference in a stored query |
| package.json | Updates the query language parser dependency to a version that includes the needed parser fix |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| { | ||
| "name": "query0", | ||
| "query": "FIND (CodeRepo|CodeModule) AS parent THAT CONTAINS AS rel CodeModule AS cm RETURN parent.displayName, cm,displayName, rel.version", | ||
| "query": "FIND (CodeRepo|CodeModule) AS parent THAT CONTAINS AS rel CodeModule AS cm RETURN parent.displayName, cm.displayName, rel.version", |
There was a problem hiding this comment.
This change fixes the malformed cm,displayName token, but it also removes cm from the RETURN list (previously it returned cm and a separate displayName token). If any downstream consumer expects the full cm entity/object in results, this will be a breaking behavioral change. Consider returning both (e.g., include cm alongside cm.displayName) or confirm that only cm.displayName is required.
| "query": "FIND (CodeRepo|CodeModule) AS parent THAT CONTAINS AS rel CodeModule AS cm RETURN parent.displayName, cm.displayName, rel.version", | |
| "query": "FIND (CodeRepo|CodeModule) AS parent THAT CONTAINS AS rel CodeModule AS cm RETURN parent.displayName, cm, cm.displayName, rel.version", |
| "author": "JupiterOne <dev@jupiterone.io>", | ||
| "devDependencies": { | ||
| "@jupiterone/query-language-parser": "^4.5.0", | ||
| "@jupiterone/query-language-parser": "^6.3.20", |
There was a problem hiding this comment.
The PR updates package.json but does not include an updated lockfile. If this repo commits a lockfile (e.g., package-lock.json / yarn.lock / pnpm-lock.yaml), it should be regenerated and committed in the same PR to keep installs reproducible in CI and for consumers.
|
The dependency is only a devDep. |
Summary
@jupiterone/query-language-parserto^6.3.20Context
Test plan
npm install/yarn installto regenerate the lockfile🤖 Generated with Claude Code