feat(core): Add Missing inherit filters field in collection import (#…

…2534)

Closes #2484

.github/workflows/build_and_test.yml

@@ -14,7 +14,7 @@ on:
       - minor
 env:
   CI: true
-  node: 18.x
+  node: 20.x
 jobs:
   build:
     name: build
@@ -25,15 +25,7 @@ jobs:
       uses: actions/setup-node@v3
       with:
         node-version: ${{ env.node }}
-#    - uses: actions/cache@v3
-#      id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-#      with:
-#        path: '**/node_modules'
-#        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-#        restore-keys: |
-#          ${{ runner.os }}-yarn-
     - name: Yarn install
-#      if: steps.yarn-cache.outputs.cache-hit != 'true'
       run: yarn install
     - name: Build
       run: yarn build
@@ -46,15 +38,7 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: ${{ env.node }}
-#      - uses: actions/cache@v3
-#        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-#        with:
-#          path: '**/node_modules'
-#          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-#          restore-keys: |
-#            ${{ runner.os }}-yarn-
       - name: Yarn install
-#        if: steps.yarn-cache.outputs.cache-hit != 'true'
         run: yarn install --prefer-offline
       - name: Build
         run: yarn lerna run ci
@@ -113,15 +97,7 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: ${{ env.node }}
-#      - uses: actions/cache@v3
-#        id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-#        with:
-#          path: '**/node_modules'
-#          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-#          restore-keys: |
-#            ${{ runner.os }}-yarn-
       - name: Yarn install
-#        if: steps.yarn-cache.outputs.cache-hit != 'true'
         run: yarn install --prefer-offline
       - name: Build
         run: yarn lerna run ci

.github/workflows/publish_and_install.yml

@@ -20,11 +20,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest]
-        # Temporarily disabled Node v18 because of this issue:
-        # https://github.com/vendure-ecommerce/vendure/actions/runs/5200017548/jobs/9378196658#step:4:48
-        # which is related to our Verdaccio setup. Will need some investigation.
-        #node-version: [16.x, 18.x]
-        node-version: [16.x]
+        node-version: [18.x, 20.x]
       fail-fast: false
     steps:
     - uses: actions/checkout@v3
@@ -35,37 +31,29 @@ jobs:
     - name: Install Verdaccio
       run: |
         npm install -g verdaccio
-        npm install -g verdaccio-auth-memory
-        npm install -g verdaccio-memory
-        npm install -g [email protected]
+        npm install -g wait-on
         tmp_registry_log=`mktemp`
-        mkdir -p $HOME/.config/verdaccio
-        cp -v ./.github/workflows/verdaccio/config.yaml $HOME/.config/verdaccio/config.yaml
-        nohup verdaccio --config $HOME/.config/verdaccio/config.yaml &>$tmp_registry_log &
-        npm-auth-to-token -u test -p test -e [email protected] -r http://0.0.0.0:4873
+        nohup verdaccio &>$tmp_registry_log &
+        wait-on http://localhost:4873
+        TOKEN_RES=$(curl -XPUT \
+          -H "Content-type: application/json" \
+          -d '{ "name": "test", "password": "test" }' \
+          'http://localhost:4873/-/user/org.couchdb.user:test')
+        TOKEN=$(echo "$TOKEN_RES" | jq -r '.token')
+        npm set registry "http://0.0.0.0:4873"
+        npm set //0.0.0.0:4873/:_authToken $TOKEN
     - name: Windows dependencies
       if: matrix.os == 'windows-latest'
       run: npm install -g @angular/cli
-#    - name: Get yarn cache directory path
-#      id: yarn-cache-dir-path
-#      run: echo "::set-output name=dir::$(yarn cache dir)"
-#    - uses: actions/cache@v3
-#      id: yarn-cache # use this to check for `cache-hit` (`steps.yarn-cache.outputs.cache-hit != 'true'`)
-#      with:
-#        path: '**/node_modules'
-#        key: ${{ runner.os }}-${{ matrix.node-version }}-yarn-${{ hashFiles('**/yarn.lock') }}
-#        restore-keys: |
-#          ${{ runner.os }}-${{ matrix.node-version }}-yarn-
     - name: Yarn install
-#      if: steps.yarn-cache.outputs.cache-hit != 'true'
       run: |
         yarn config set unsafe-perm true
         yarn install --network-timeout 1000000 --prefer-offline
       env:
         CI: true
     - name: Publish to Verdaccio
       run: |
-        yarn lerna publish prepatch --preid ci --no-push --no-git-tag-version --no-commit-hooks --force-publish "*" --yes --dist-tag ci --registry http://0.0.0.0:4873
+        yarn lerna publish prepatch --preid ci --no-push --no-git-tag-version --no-commit-hooks --force-publish "*" --yes --dist-tag ci --registry http://localhost:4873
     - name: Install via @vendure/create
       run: |
         mkdir -p $HOME/install

CHANGELOG.md

@@ -1,5 +1,8 @@
 ## <small>2.1.3 (2023-11-17)</small>
 
+#### Security
+
+This patch addresses the following security advisory: https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-wm63-7627-ch33
 
 #### Fixes
 

packages/core/src/data-import/providers/populator/populator.ts

@@ -148,6 +148,7 @@ export class Populator {
                 assetIds: assets.map(a => a.id.toString()),
                 featuredAssetId: assets.length ? assets[0].id.toString() : undefined,
                 filters,
+                inheritFilters: collectionDef.inheritFilters ?? true,
             });
             collectionMap.set(collectionDef.name, collection);
         }

packages/core/src/data-import/types.ts

@@ -27,6 +27,7 @@ export interface CollectionDefinition {
     slug?: string;
     private?: boolean;
     filters?: CollectionFilterDefinition[];
+    inheritFilters?: boolean;
     parentName?: string;
     assetPaths?: string[];
 }