Added reactor-extension-alloy as a package within alloy by Spencer-Smith · Pull Request #1448 · adobe/alloy

Spencer-Smith · 2026-02-20T17:46:35Z

Description

Cloned reactor-extension-alloy into packages/reactor-extension, preserving version history for files
Updated package.json in that package to get @adobe/alloy dependency from within the workspace
Replicated reactor-extension-alloy workflows in the workspace root
Updated pnpm scripts at workspace root to build and run tests in the extension package, added functionality to run unit/integration tests for just a single package

TODO:

Move reactor-extension-alloy specific secrets to alloy github project
(?) Unify eslint configs and run against entire project (right now root level lint config does not check reactor-extension package files, and then reactor-extension package runs its own lint config against its files)
(?) Simplify testing paradigm
(?) Consolidate workflows
Test new release process

Related Issue

Jira

Motivation and Context

Screenshots (if appropriate):

N/A

Checklist:

I have signed the Adobe Open Source CLA or I'm an Adobe employee.
I have made any necessary test changes and all tests pass.
I have run the Sandbox successfully.
I have added a Changeset (pnpm changeset) or it is not necessary because this PR is not consumer-facing.

…e hidden (#474)

#475)

…library is selected. (#477)

* Fix data collection 'all settings' functional test * Format

* Remove stylus dependency * Replace the <Alert> component with Spectrum's <InlineAlert> * Remove @spectrum tokens and typography * Give field descriptions the same text color as labels

…e fields (#481) * Add new validation and UI for link callbacks, add clear button to code fields * Fix useEffect return value, Fix init, Change error style for code preview, Only show clear button when it was set

* Added ability to set thirdPartyCookiesEnabled from a data element * Remove console and reuse boolean or data element validation

…d from API. (#486)

* Update dependencies * Update non-eslint dev deps * Remove/migrate deprecated .eslintignore file * Run prettier * npm audit fix

…d library (#588)

…s enabled (#594) * Show advertising settings in the send event view when the component is enabled. * Skip for the moment * Fix the view rendering. * Fix the rendering.

* Update @adobe/alloy to 2.31.0 * Update @adobe/alloy to 2.31.1

Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.17.1 to 8.18.0. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v8.17.1...v8.18.0) --- updated-dependencies: - dependency-name: ajv dependency-version: 8.18.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…8a578cc1a89a6e1987' git-subtree-dir: packages/reactor-extension git-subtree-mainline: 366cc96 git-subtree-split: 1e545ed

… scripts+workflows to project root

changeset-bot · 2026-02-20T17:46:40Z

🦋 Changeset detected

Latest commit: c047c79

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-advanced-security · 2026-02-20T17:51:02Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

packages/reactor-extension/src/view/utils/deepAssign.js

+      return;
+    }
+
+    target[key] = source[key];


In general, to fix prototype pollution in deep merge/assign utilities, you must prevent sensitive prototype-related keys (__proto__, constructor, and often prototype) from being written or recursed into, regardless of their values. You can either:

Block those keys explicitly, or

Only recurse/assign when the destination already has the property and the key is safe.

The minimal, safest fix here—without changing the public behavior for normal keys—is to add a guard inside deepAssignObject so that any key equal to __proto__, constructor, or prototype is skipped entirely. This avoids ever writing to Object.prototype or other prototypes while leaving normal merging semantics intact. We do not need to touch the isNil and isObject helpers or the exported wrapper function.

Concretely:

In deepAssignObject, before checking isObject(target[key]) && isObject(source[key]), add a condition that returns early for unsafe keys.

Keep using Object.keys(source), but simply return from the callback when the key is unsafe, so nothing is assigned or recursed for that key.

No new imports or external dependencies are required; this is pure JavaScript logic inside the same file.

The change is localized to packages/reactor-extension/src/view/utils/deepAssign.js, lines 16–24, around the Object.keys(source).forEach loop.

packages/reactor-extension/test/unit/helpers/deepAssign.js

+      return;
+    }
+
+    target[key] = source[key];


In general, to fix prototype-polluting deep assignment, you must prevent writes to Object.prototype (and other prototypes) via special keys. This is commonly done by skipping properties named __proto__, constructor, and sometimes prototype, or by only recursing into own properties of the destination object. Here, the minimal, behavior-preserving change is to add a guard that omits these dangerous keys from the merge.

The best fix with minimal functional change is to add a conditional inside the Object.keys(source).forEach loop in deepAssignObject that checks the current key, and if it is __proto__, constructor, or prototype, immediately returns from the callback (i.e., skips that key). For all other keys, the behavior remains exactly the same: if both target[key] and source[key] are objects, recurse; otherwise, assign target[key] = source[key]. This change is localized to packages/reactor-extension/test/unit/helpers/deepAssign.js within the body of deepAssignObject and requires no new imports or helper methods.

carterworks

One bump we will run into: .changeset/pre.json says that all repos will be in beta mode at the same time. I'm not sure what will happen if we release the extension without releasing alloy. Will it mess up the beta version numbers? Will it also release alloy? I don't know.

.github/workflows/changeset-publish.yml

carterworks · 2026-02-20T20:25:23Z

.github/workflows/changeset-publish.yml

+            p.dependencies['@adobe/alloy'] = process.env.ALLOY_NEW;
+            fs.writeFileSync('package.json', JSON.stringify(p, null, 2));
+          "
+          pnpm version patch --no-commit-hooks


What do you think about always doing the same kind of version bump as @adobe/alloy (patch/minor/major) instead of always doing a patch version bump?

.github/workflows/changeset-publish.yml

carterworks · 2026-02-20T20:30:32Z

.github/workflows/changeset-publish.yml

+          echo "Root version after versioning: ${VERSION}"
+
+      - name: Bump extension when @adobe/alloy was released
+        if: hashFiles('packages/reactor-extension/package.json') != ''


This conditional (and the copy of it on line 241) will always return true, since you have created that file. hashFiles returns a hash of the file, and the hash of a file that exists will never be ''

… the Alloy Dev workflow

adobe-alloy-bot and others added 30 commits February 27, 2025 17:17

[skip ci] 2.29.0-beta.3

d801179

Adjust colors of buttons and inputs to match older gray values (#472)

865c487

[skip ci] 2.29.0-beta.4

74ebe72

Context is a required component now. (#473)

d58fc96

[skip ci] 2.29.0-beta.5

0c22996

After making the context component required, the context settings wer…

c797baa

…e hidden (#474)

[skip ci] 2.29.0-beta.6

ca00a4e

Fix an error that occurs when saving with an open custom build section (

630ca3b

#475)

[skip ci] 2.29.0-beta.7

9ee4dac

Use latest node. (#476)

2ef4804

[skip ci] 2.29.0-beta.8

21c7971

[skip ci] 2.29.0

343e769

PDCL-13324 Validation error for Variable data element when a working …

6d77898

…library is selected. (#477)

[skip ci] 2.29.1

aed05c6

Fix broken context tests (#478)

456fb52

* Fix data collection 'all settings' functional test * Format

Refactor CSS and address accessibility concerns (#479)

988c6c4

* Remove stylus dependency * Replace the <Alert> component with Spectrum's <InlineAlert> * Remove @spectrum tokens and typography * Give field descriptions the same text color as labels

Add SonarQube action. (#482)

fdb3da2

Transform the action in a warning

609ee94

Added ability to set thirdPartyCookiesEnabled from a data element (#480)

d2e56d0

* Added ability to set thirdPartyCookiesEnabled from a data element * Remove console and reuse boolean or data element validation

Update alloy for 2.30.0 extension release (#483)

fb86deb

[skip ci] 2.30.0-beta.0

494a606

Remove onBeforeLinkClickSend from settings object when necessary. (#485)

b1ed4fa

[skip ci] 2.30.0-beta.1

a1c173e

[skip ci] 2.30.0

833f971

Update dependencies. (#487)

dccf154

PLATIR-49623 Do not crash the view when no default sandbox is receive…

4939892

…d from API. (#486)

[skip ci] 2.30.1-beta.0

77e1daa

[skip ci] 2.30.1

09b5f42

Update dependencies (#489)

32a0486

* Update dependencies * Update non-eslint dev deps * Remove/migrate deprecated .eslintignore file * Run prettier * npm audit fix

adobe-alloy-bot and others added 14 commits February 9, 2026 22:00

[skip ci] 2.34.0-beta.55

586694e

[skip ci] 2.34.0

53ca702

Fallback to tenant-specific domain when switching back to Tags-manage…

de37816

…d library (#588)

Show advertising settings in the send event view when the component i…

b452a79

…s enabled (#594) * Show advertising settings in the send event view when the component is enabled. * Skip for the moment * Fix the view rendering. * Fix the rendering.

chore: update alloy to 2.31.1-beta.0 (#595)

acf398a

[skip ci] 2.34.1-beta.0

9e422e6

Updated @adobe/alloy to 2.31.1 (#597)

9bed307

* Update @adobe/alloy to 2.31.0 * Update @adobe/alloy to 2.31.1

[skip ci] 2.34.1-beta.1

9341e5d

[skip ci] 2.34.1

8d72f00

Add tests. (#596)

30369f4

Add 'packages/reactor-extension/' from commit '1e545edab723b478525807…

7d11845

…8a578cc1a89a6e1987' git-subtree-dir: packages/reactor-extension git-subtree-mainline: 366cc96 git-subtree-split: 1e545ed

Migrated reactor-extension-alloy to packages/reactor-extension; moved…

977d955

… scripts+workflows to project root

Added empty changeset

4084c30

Spencer-Smith self-assigned this Feb 20, 2026

Spencer-Smith added the ignore-for-release Do not include this PR in release notes label Feb 20, 2026

github-advanced-security bot found potential problems Feb 20, 2026

View reviewed changes

Spencer-Smith added 2 commits February 20, 2026 11:11

Build at workspace root as part of github workflows

f15b1ec

Add build preinstalled to base build pnpm script

d8bee88

carterworks marked this pull request as draft February 20, 2026 20:17

Spencer-Smith added 2 commits February 20, 2026 13:20

Fix test failure

475b0aa

Add back shortcut for test:unit for husky

329788f

carterworks reviewed Feb 20, 2026

View reviewed changes

Spencer-Smith added 5 commits February 20, 2026 15:27

Step one towards linter config integration (move to same file)

17c7700

Update pnpm lockfile, PR feedback on changeset publish updates

7133f54

Remove extension-quality workflow as its checks are consolidated into…

29057f8

… the Alloy Dev workflow

Format core files with prettier

5c78aab

Buld alloy lib for extension tests

c047c79

@@ -15,6 +15,11 @@
             const deepAssignObject = (target, source) => {
               Object.keys(source).forEach((key) => {
+                // Prevent prototype pollution by blocking dangerous keys
+                if (key === "__proto__" || key === "constructor" || key === "prototype") {
+                  return;
+                }
                 if (isObject(target[key]) && isObject(source[key])) {
                   deepAssignObject(target[key], source[key]);
                   return;

@@ -15,6 +15,10 @@
             const deepAssignObject = (target, source) => {
               Object.keys(source).forEach((key) => {
+                if (key === "__proto__" || key === "constructor" || key === "prototype") {
+                  return;
+                }
                 if (isObject(target[key]) && isObject(source[key])) {
                   deepAssignObject(target[key], source[key]);
                   return;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

Added reactor-extension-alloy as a package within alloy#1448

Added reactor-extension-alloy as a package within alloy#1448
Spencer-Smith wants to merge 1979 commits intomainfrom
joinExtensionRepo

Spencer-Smith commented Feb 20, 2026

Uh oh!

changeset-bot bot commented Feb 20, 2026 •

edited

Loading

Uh oh!

github-advanced-security bot commented Feb 20, 2026

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

carterworks left a comment

Uh oh!

Uh oh!

carterworks Feb 20, 2026

Uh oh!

Uh oh!

carterworks Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Comments

Conversation

Spencer-Smith commented Feb 20, 2026

Description

Related Issue

Motivation and Context

Screenshots (if appropriate):

Checklist:

Uh oh!

changeset-bot bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-advanced-security bot commented Feb 20, 2026

Uh oh!

Check warning

Uh oh!

Uh oh!

Copilot Autofix

Check warning

Uh oh!

Uh oh!

Copilot Autofix

carterworks left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

carterworks Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

carterworks Feb 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

changeset-bot bot commented Feb 20, 2026 •

edited

Loading