chore(release): staging to production - 2026.03.13

[github-actions]

🚀 Release: Staging to Production

Release Date: 2026-03-13

Changes in this release

• fix: remove debug console.log statements that leak sensitive data (b5dd547)
• fix: resolve build errors in components and server packages (8903768)
• chore: removed old support links (chore: removed old support links #1010) (03fdb80)
• Revert "fix(components): optimize AAIDomains loader memory for large datasets" (b374ef7)
• style(components): fix Prettier formatting in AAIDomains loader (c08042c)
• style(documentstore): fix Prettier formatting in documentstore service (801c074)
• fix(documentstore): batch vector upsert with RecordManager guard (e38a3e3)
• fix(documentstore): batch chunk saves to prevent OOM on large datasets (dac6859)
• fix(components): preserve domain_tags for contentFields compatibility (c55c910)
• fix(components): optimize AAIDomains loader memory for large datasets (6c47607)
• fix: upgrade zod to ^3.25.0 for MCP SDK compatibility (902b6e2)
• fix: upgrade zod to ^3.25.0 for MCP SDK compatibility (3cd4676)
• style: fix remaining prettier formatting issues (ae2638e)
• style: fix console.log line length lint errors (07acddd)
• style: fix additional lint errors (fd95a22)
• style: remove trailing whitespace from MCP files (4893117)
• 🔒 Security: Fix CVE-2026-27606 - Rollup path traversal vulnerability (1325827)
• fix(document-store): inject req.user into refresh body to prevent TypeError (d5659a3)

---

This PR is automatically created/updated when commits are pushed to staging.
Merging this PR will trigger the release workflow to create a new GitHub release.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
answerai-docs	Building	Preview	Mar 12, 2026 1:04am
the-answerai	Building	Preview	Mar 12, 2026 1:04am

[claude]

PR Review: chore(release): staging to production - 2026.03.12

This release contains targeted fixes for memory/OOM issues in document loading and vector store upsert operations, plus a zod version upgrade for MCP SDK compatibility. Overall the changes are well-motivated and address real production problems.

---

1. AAIDomains.ts — Memory Optimization

Good: In-place metadata mutation via for...of instead of docs.map() is a clean improvement and avoids allocating a new array + objects just to reassign metadata.

Good: Renaming allDomains: any[] → allDocs: IDocument[] adds proper typing and makes the intent clearer.

Good: Creating documents per page (pageDocs) and pushing into allDocs is logically equivalent to the old end-of-load .map() but reduces peak memory by not holding raw domain objects and document objects simultaneously.

Subtle concern — in-place mutation of API response objects:

// Before: created a new object with spread (preserved original)
const domainsWithTags = data.map((domain: any) => ({
    ...domain,
    tags: domain.domain_tags?.map(...)
}))

// After: mutates the original objects from the API response
for (const domain of data as any[]) {
    domain.tags = domain.domain_tags?.map(...)
}

The old code created a copy; the new code mutates data directly. This is fine here because data is not used again after this point, but it's worth noting for future maintainability. The domain_tags field is intentionally preserved (see commit c55c910f), which is the correct behavior for contentFields compatibility.

---

2. documentstore/index.ts — Batch Chunk Saves

Good: Batching Promise.all() into groups of 500 prevents opening thousands of concurrent DB connections for large document stores.

Minor concern — individual saves vs. bulk insert:
Each chunk is still saved individually (repository.save(dChunk) per row), just limited to 500 concurrent operations. For very large datasets (e.g., 10k+ chunks), using a bulk insert (e.g., repository.insert(batch)) would be significantly faster and produce less DB load. This is a follow-up optimization, not a blocker.

Minor concern — no transaction wrapper:
If a mid-batch chunk save fails, previously saved batches are committed but subsequent batches are not. The error is re-thrown which will prevent the loader metrics from being updated, but the partial chunk data remains in DB. This was a pre-existing issue — just flagging it as technical debt.

---

3. documentstore/index.ts — Batch Vector Upsert

Good: This is the most important fix — loading all chunks into memory before upsert was the root cause of OOM on large document stores. Pagination with skip/take is the right approach.

Potential issue — indexResult only captures the last batch:

let indexResult: any
// ...
for (let skip = 0; skip < totalCount; skip += UPSERT_BATCH_SIZE) {
    // ...
    indexResult = await vectorStoreObj.vectorStoreMethods.upsert(vStoreNodeData, options)
    // ^^^ Each iteration overwrites the previous result
}

// Save to DB
if (indexResult) {
    // Only the last batch's result is recorded
}

If upsert returns counts/stats (e.g., { numAdded: N }), only the last batch's count is persisted. Depending on what indexResult is used for downstream, this could mean underreported upsert metrics. Worth checking what upsertHistory captures and whether the metrics in indexResult need to be aggregated.

Potential issue — _createVectorStoreObject called per batch:

for (let skip = 0; skip < totalCount; skip += UPSERT_BATCH_SIZE) {
    // ...
    const vectorStoreObj = await _createVectorStoreObject(componentNodes, data, vStoreNodeData, upsertHistory)
    indexResult = await vectorStoreObj.vectorStoreMethods.upsert(vStoreNodeData, options)
}

_createVectorStoreObject is called on every iteration. If this function establishes connections (e.g., to Pinecone, Weaviate, Qdrant), this may create/destroy connections on each batch, adding latency and potentially hitting rate limits. Consider hoisting the vectorStoreObj creation outside the loop if the implementation allows it.

RecordManager detection:

const isFullCleanup = recordManagerObj && data.recordManagerConfig && JSON.parse(data.recordManagerConfig)?.cleanup === 'full'

If data.recordManagerConfig is already a parsed object (not a string), JSON.parse() will throw. Consider guarding:

const config = typeof data.recordManagerConfig === 'string'
    ? JSON.parse(data.recordManagerConfig)
    : data.recordManagerConfig
const isFullCleanup = recordManagerObj && config?.cleanup === 'full'

---

4. zod 3.22.4 → ^3.25.0

Good: Necessary for MCP SDK compatibility. zod 3.x maintains backward compatibility within major versions, and the wide blast radius in pnpm-lock.yaml (all LangChain packages now resolved against 3.25.76) is expected and correct.

Minor: Pinning was 3.22.4 (exact), now ^3.25.0 (caret). This means future pnpm install runs could resolve to 3.26.x etc. If strict reproducibility is needed, consider pinning to 3.25.76 exact rather than using a range. Not critical, just a tradeoff to be aware of.

---

Summary

Area	Verdict
Memory optimization (AAIDomains)	✅ Solid improvement
Batch chunk saves	✅ Fixes OOM, minor follow-up for bulk insert
Batch vector upsert	✅ Core fix is correct — see notes on indexResult aggregation and _createVectorStoreObject hoisting
zod upgrade	✅ Correct and necessary

Blocking issues: None
Recommended follow-ups:

1. Verify indexResult metrics are acceptable when only last-batch result is recorded
2. Check whether _createVectorStoreObject can be hoisted outside the upsert loop
3. Guard JSON.parse(data.recordManagerConfig) in case it's already an object

Overall this is a well-scoped fix for production OOM issues. Approve with the above notes.

🤖 Reviewed by Claude Code

[claude]

PR Review by Claude Code (2026-03-12): The current diff contains only 2 files -- packages/components/package.json (zod bump from 3.22.4 to ^3.25.0) and pnpm-lock.yaml. The AAIDomains and documentstore changes visible in the commit history were reverted before HEAD. No critical or major issues found. Minor notes: (1) zod caret range ^3.25.0 vs previous exact pin -- deterministic via lockfile but worth deciding on policy; (2) @types/node peer resolution shifted from 25.2.2 to 18.15.11 as a side effect. The zod upgrade is correct and necessary -- @modelcontextprotocol/sdk@1.26.0 imports zod/v4 and requires >=3.25; the exact 3.22.4 pin caused all MCP tools to fail on startup. Resolved version 3.25.76 is consistent across all peer deps. Assessment: Approve. Recommend verifying Vercel builds and MCP tool loading in staging before merging to production.

[claude]

PR Review: staging to production 2026.03.12

Overall Assessment: This release PR is generally safe to merge. The critical security fix and dependency upgrades are well-scoped. A few concerns are noted below.

STRENGTHS

Security fix correct and necessary: Rollup upgraded from 4.45.0 to 4.59.0 and 3.29.5 to 3.30.0 to address CVE-2026-27606 path traversal vulnerability. The pnpm override approach is correct.

Zod upgrade appropriate: Moving from pinned 3.22.4 to ^3.25.0 unblocks MCP SDK compatibility. Lockfile consistently resolves 3.25.76 across all dependent packages.

Documentstore batching fixes: Batching vector upserts and chunk saves to prevent OOM on large datasets is a solid targeted fix.

Formatting changes are clean: The Prettier fixes are mechanical and non-risky.

CONCERNS

1. Excessive DEBUG console.log statements shipping to production (Medium severity)

These files contain dense DEBUG logging added for investigation that was not removed: packages/components/nodes/tools/MCP/Confluence/ConfluenceMCP.ts, packages/components/nodes/tools/MCP/Jira/JiraMCP.ts, packages/components/nodes/tools/MCP/core.ts, packages/components/src/utils.ts, packages/server/src/utils/index.ts.

While none log actual secret values (good!), they do log: credential IDs (UUIDs), workspaceIds, timing data for every flow run, and internal package paths. The console.time/console.timeEnd blocks add overhead per node init. Recommend a follow-up ticket to replace these with the existing logger.debug() pattern that respects log level config.

2. Revert + Re-apply of AAIDomains memory optimization (Low severity)

The commit history shows the memory optimization was applied, then reverted, then re-applied alongside a domain_tags preservation fix. Please confirm the final shipped state has both the memory optimization AND domain_tags preservation. A smoke test against a large domain dataset in staging would be prudent.

3. @types/node version inconsistency in lockfile (Low severity)

In pnpm-lock.yaml, some packages shifted from @types/node@25.2.2 to @types/node@18.15.11 (salesforce-mcp, typeorm, ts-node, Jest). This appears to be an incidental side effect of the zod upgrade changing peer dep resolution. Verify this does not cause TypeScript compile regressions, particularly in packages/server where typeorm is used.

SUMMARY

Security fix (CVE-2026-27606 rollup): Good
Zod upgrade for MCP compatibility: Good
Documentstore OOM batching fixes: Good
Debug console.log in production: Needs follow-up ticket
AAIDomains revert/re-apply clarity: Confirm final state
@types/node version shift: Verify no TS compile regressions

Recommendation: Merge is acceptable given the security urgency. File a cleanup ticket for the DEBUG logging before the next release cycle.

Reviewed with Claude Code

[claude]

PR Review: chore(release): staging to production - 2026.03.13

Reviewer: Claude Code (automated review)
PR Type: Release (staging -> production)
Changes: 15 files, +512 / -620 lines

Summary

This is a release PR aggregating bug fixes, security patches, and dependency upgrades from staging to production. The changes span memory optimization for document processing, a critical security CVE fix, MCP SDK compatibility, a document store user injection fix, and documentation cleanup. Overall the code quality is solid. Key concerns are noted below.

---

Critical Issues

1. Debug console.log statements shipping to production

Multiple files contain verbose [DEBUG] console logging that was added for troubleshooting and never removed before this release:

• packages/components/src/utils.ts - [getCredentialData DEBUG] logs including credential names and decrypted data key names
• packages/server/src/utils/index.ts - [NODE INIT DEBUG], [checkAndRefreshCredentialsBeforeInit DEBUG] logs with node names, credential IDs, and timestamps
• packages/components/nodes/tools/MCP/Confluence/ConfluenceMCP.ts - [CONFLUENCE MCP DEBUG] logs including actual email values
• packages/components/nodes/tools/MCP/Jira/JiraMCP.ts - Same pattern - logs jiraApiEmail value in plaintext
• packages/components/nodes/tools/MCP/core.ts - [MCP TOOLKIT DEBUG] logs

The Jira and Confluence MCP files specifically log actual email addresses (not just boolean existence checks). Example from JiraMCP.ts:

console.log('[JIRA MCP DEBUG]   - email exists:', !!jiraApiEmail, '(value:', jiraApiEmail || 'MISSING', ')')

This logs the real email value to production stdout. These should be removed or replaced with logger.debug() calls gated behind a log level.

Severity: Critical - blocks production release

---

2. Mutation of req.body in documentstore controller

In packages/server/src/controllers/documentstore/index.ts:

const body = req.body || {}
body.user = req.user

The || {} guard only creates a new object if req.body is falsy. In the common case where req.body is a populated object (a normal POST/PUT with JSON), this mutates the original request body directly. While functionally correct here, it is an unexpected side effect. Safer approach:

const body = { ...(req.body || {}), user: req.user }

Severity: Major

---

Major Concerns

3. Duplicate zod upgrade commits

Commits 3cd46760 and 902b6e2e both apply the same zod upgrade fix. Harmless in the final state but clutters the git history and suggests a workflow issue during the fix.

4. AAIDomains memory optimization reverted without replacement

The commit history includes: optimize AAIDomains loader -> preserve domain_tags patch -> revert AAIDomains optimization -> broader documentstore batch pipeline. The final diff does NOT include the AAIDomains component-level changes (they were reverted). The documentstore service-level batching fixes are present, but the original OOM issue for large datasets in the AAIDomains component is still unresolved. A follow-up ticket should track re-introducing that optimization with the domain_tags compatibility fix preserved.

---

Minor Issues

5. console.time() / console.timeEnd() calls throughout packages/server/src/utils/index.ts and packages/components/src/utils.ts write to stdout in production. These should use the application logger abstraction.

6. The email logging in MCP files (issue 1) is specifically a data exposure concern beyond just debug noise - the actual email string is logged when it exists.

---

Positive Observations

• The CVE-2026-27606 security fix (Rollup path traversal, CVSS 9.8) is excellently documented in the commit message with full CVE reference, affected versions, and patched versions. This is exactly the right way to commit security fixes.
• The req.body || {} guard in documentstore controller correctly fixes the TypeError when the body is undefined (AGENT-714). The intent is sound even if the implementation has a minor issue.
• Zod upgrade from 3.22.4 to ^3.25.0 is a necessary compatibility fix for @modelcontextprotocol/sdk@1.26.0 and is well-explained in the commit message.
• Lint and formatting fixes are cleanly separated into their own commits, making the diff easier to review.
• Documentstore batching fixes (batch chunk saves, batch vector upsert with RecordManager guard) address real OOM issues on large datasets and are a meaningful operational improvement.
• Support link update (Airtable form to GitHub Issues) is a good housekeeping change.
• No new routes were added; enforceAbility middleware was not weakened; organizationId filtering was not removed.

---

Security Checklist

• No hardcoded secrets in the diff
• Rollup CVE-2026-27606 patched (4.45.0 to 4.59.0)
• Debug logs expose user emails in production (Jira/Confluence MCP) - needs remediation before merging
• enforceAbility middleware not modified
• organizationId filtering not weakened
• No new routes added without auth

---

Recommendation: Request Changes

The blocking issue is the debug console.log statements shipping to production, specifically the email value exposure in JiraMCP.ts and ConfluenceMCP.ts. The req.body mutation is a secondary but real concern.

Suggested next steps:

1. Remove all [DEBUG] console.log / console.time calls from the 5 files listed above, or replace with logger.debug() gated behind a log level
2. Fix req.body mutation to use object spread: const body = { ...(req.body || {}), user: req.user }
3. Open a follow-up ticket for AAIDomains loader memory optimization (OOM still unresolved at the component level)
4. Re-push to staging; this release PR will auto-update