Lock down VM2 version (#2959)

* Lock down VM2 version

* Add test, tidy up

* Update changelogs

Author: stwiname

packages/node-core/CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- Lock down VM2 version to avoid a breaking change (#2959)
 
 ## [18.5.0] - 2025-10-15
 ### Changed

packages/node-core/package.json

@@ -51,7 +51,7 @@
     "source-map": "^0.7.4",
     "tar": "^7.4.3",
     "toposort-class": "^1.0.1",
-    "vm2": "^3.9.19",
+    "vm2": "3.9.19",
     "yargs": "^16.2.0"
   },
   "devDependencies": {

packages/node-core/src/indexer/sandbox.spec.ts

@@ -5,15 +5,38 @@ import {existsSync, writeFileSync, mkdirSync, rmSync} from 'fs';
 import {tmpdir} from 'os';
 import * as path from 'path';
 import {join} from 'path';
-import {VMScript} from 'vm2';
+import {NodeVM, VMScript} from 'vm2';
 import {NodeConfig} from '../configure/NodeConfig';
 import {IndexerSandbox, TestSandbox} from './sandbox';
 
 describe('sandbox for subql-node', () => {
   let vm: IndexerSandbox;
 
   afterEach(() => {
-    vm.removeAllListeners();
+    vm?.removeAllListeners();
+  });
+
+  // This was caused by vm2@3.10.0 changes that were breaking in a minor release.
+  it('Can use older libraries that use prototypes to set properties', () => {
+    const script = `
+      const util = require('util');
+      const EventEmitter = require('events');
+
+      function MyStream() {
+        console.log("This is sha1");
+      }
+
+      util.inherits(MyStream, EventEmitter);
+    `;
+
+    const vmScript = new VMScript(script);
+    const vm = new NodeVM({
+      console: 'inherit',
+      require: {
+        builtin: ['util', 'events'],
+      },
+    });
+    expect(() => vm.run(vmScript)).not.toThrow();
   });
 
   it('wait until promise resolved', async () => {
@@ -232,7 +255,7 @@ describe('Sandbox Environment Variable Support', () => {
           apiKey: process.env.API_KEY,
           hasProcess: typeof process !== 'undefined'
         };
-        
+
         global.subqlTests = [result];
       `;
       const testPath = join(srcDir, 'test.js');
@@ -269,7 +292,7 @@ describe('Sandbox Environment Variable Support', () => {
           hasProcess: typeof process !== 'undefined',
           processType: typeof process
         };
-        
+
         global.subqlTests = [result];
       `;
       const testPath = join(srcDir, 'test.js');

packages/node-core/src/indexer/sandbox.ts

@@ -11,7 +11,6 @@ import {SourceMapConsumer, NullableMappedPosition} from 'source-map';
 import {NodeVM, NodeVMOptions, VMError, VMScript} from 'vm2';
 import {NodeConfig} from '../configure/NodeConfig';
 import {getLogger} from '../logger';
-import {loadProjectEnvConfig, createSandboxProcessEnv} from '../utils/env';
 import {timeout} from '../utils/promise';
 
 export const SANDBOX_DEFAULT_BUILTINS = ['assert', 'buffer', 'crypto', 'util', 'path', 'url', 'stream'];

packages/node/CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Fixed
+- Lock down VM2 version to avoid a breaking change (#2959)
 
 ## [6.4.2] - 2025-10-22
 ### Changed

yarn.lock

@@ -10264,7 +10264,7 @@ __metadata:
     source-map: "npm:^0.7.4"
     tar: "npm:^7.4.3"
     toposort-class: "npm:^1.0.1"
-    vm2: "npm:^3.9.19"
+    vm2: "npm:3.9.19"
     yargs: "npm:^16.2.0"
   languageName: unknown
   linkType: soft
@@ -12574,14 +12574,23 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn-walk@npm:^8.1.1, acorn-walk@npm:^8.2.0":
+"acorn-walk@npm:^8.1.1":
   version: 8.2.0
   resolution: "acorn-walk@npm:8.2.0"
   checksum: 10/e69f7234f2adfeb16db3671429a7c80894105bd7534cb2032acf01bb26e6a847952d11a062d071420b43f8d82e33d2e57f26fe87d9cce0853e8143d8910ff1de
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.14.0, acorn@npm:^8.15.0":
+"acorn-walk@npm:^8.2.0":
+  version: 8.3.4
+  resolution: "acorn-walk@npm:8.3.4"
+  dependencies:
+    acorn: "npm:^8.11.0"
+  checksum: 10/871386764e1451c637bb8ab9f76f4995d408057e9909be6fb5ad68537ae3375d85e6a6f170b98989f44ab3ff6c74ad120bc2779a3d577606e7a0cd2b4efcaf77
+  languageName: node
+  linkType: hard
+
+"acorn@npm:^8.11.0, acorn@npm:^8.14.0, acorn@npm:^8.15.0, acorn@npm:^8.7.0":
   version: 8.15.0
   resolution: "acorn@npm:8.15.0"
   bin:
@@ -12590,7 +12599,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"acorn@npm:^8.4.1, acorn@npm:^8.7.0, acorn@npm:^8.7.1":
+"acorn@npm:^8.4.1, acorn@npm:^8.7.1":
   version: 8.7.1
   resolution: "acorn@npm:8.7.1"
   bin:
@@ -28268,7 +28277,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"vm2@npm:^3.9.19":
+"vm2@npm:3.9.19":
   version: 3.9.19
   resolution: "vm2@npm:3.9.19"
   dependencies: