Skip to content

feat(replay): Skip addHoverClass when stylesheet is >= 1MB#130

Merged
billyvg merged 1 commit intosentry-v2from
feat-replay-disable-hover-class-on-large-css
Nov 8, 2023
Merged

feat(replay): Skip addHoverClass when stylesheet is >= 1MB#130
billyvg merged 1 commit intosentry-v2from
feat-replay-disable-hover-class-on-large-css

Conversation

@billyvg
Copy link
Copy Markdown
Member

@billyvg billyvg commented Nov 8, 2023

Large stylesheets will cause addHoverClass to block the main UI thread when viewing a replay. Turn this off when stylesheet is >= 1MB.

Large stylesheets will cause `addHoverClass` to block the main UI thread when viewing a replay. Turn this off when stylesheet is >= 1MB.
@billyvg billyvg marked this pull request as ready for review November 8, 2023 22:14
@billyvg billyvg merged commit e3a066e into sentry-v2 Nov 8, 2023
@billyvg billyvg deleted the feat-replay-disable-hover-class-on-large-css branch November 8, 2023 22:36
billyvg added a commit that referenced this pull request Apr 26, 2024
Large stylesheets will cause `addHoverClass` to block the main UI thread
when viewing a replay. Turn this off when stylesheet is >= 1MB.
chargome added a commit that referenced this pull request Apr 1, 2026
Remove the `fast-mhtml` dependency which was only used in one test
utility function (`packages/rrweb/test/utils.ts`) for parsing MHTML
snapshots in replayer E2E tests.

Replace with a minimal inline parser (~30 lines) that handles multipart
MIME boundary splitting and quoted-printable content decoding. All 47
replayer tests pass.

`fast-mhtml` pulled in `cheerio`, `express`, `undici`, `qs`, `bluebird`,
and `cookie` — a massive transitive tree for a simple test helper. This
removes ~584 lines from `yarn.lock`.

### Dependabot alerts resolved

**Fully resolved** (vulnerable package completely removed from
lockfile):

| Alert | Severity | Package | Summary |
|-------|----------|---------|---------|
| #166 | MEDIUM | `qs` | arrayLimit bypass allows DoS via memory
exhaustion |
| #183 | LOW | `qs` | arrayLimit bypass in comma parsing allows DoS |

**Partially resolved** (some entries removed, but package still exists
via other dependency chains):

| Alert | Severity | Package | Remaining source |
|-------|----------|---------|-----------------|
| #225, #224, #223, #222, #221, #170, #130, #112 | HIGH/MEDIUM/LOW |
`undici` | Still pulled in by `puppeteer` (Phase 3) |
| #100 | LOW | `cookie` | Still pulled in by `@sveltejs/kit` (Phase 5) |

closes
https://linear.app/getsentry/issue/SDK-1097/replace-fast-mhtml-9-alerts

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: chargome <chargome@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants