langfuse-core - npm Package Compare versions

Comparing version 3.31.0 to 3.31.1

lib/index.cjs.js

@@ -318,11 +318,14 @@ 'use strict';
 if (typeof process !== "undefined" && process.versions?.node) {
+  // Use wrapper to prevent bundlers from trying to resolve the dynamic import
+  // Otherwise, the import will be incorrectly resolved as a static import even though it's dynamic
+  // Test for browser environment would fail because the import will be incorrectly resolved as a static import and fs and crypto will be unavailable
+  const dynamicImport = module => {
+    return import( /* webpackIgnore: true */module);
+  };
   // Node
-  try {
-    fs = require("fs");
-    cryptoModule = require("crypto");
-  } catch (error) {
-    console.error("Error loading crypto or fs module", error);
-  }
+  Promise.all([dynamicImport("fs"), dynamicImport("crypto")]).then(([importedFs, importedCrypto]) => {
+    fs = importedFs;
+    cryptoModule = importedCrypto;
+  }).catch(); // Errors are handled on runtime
 } else if (typeof crypto !== "undefined") {
-  // Edge Runtime, Cloudflare Workers, etc.
   cryptoModule = crypto;
@@ -329,0 +332,0 @@ }

package.json

 {
   "name": "langfuse-core",
-  "version": "3.31.0",
+  "version": "3.31.1",
   "engines": {
@@ -40,3 +40,3 @@ "node": ">=18"
   },
-  "gitHead": "d17b812cca66dc04db794dc80dd59386ebf17e68"
+  "gitHead": "058a412c3d1bca571d1d2af0d7a801a306e99fa8"
 }

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

747741

increased by0.29%

Lines of code

8214

increased by0.07%

Number of low supply chain risk alerts

5

decreased by-28.57%

No dependency changes