[claude]

Note

Description

stripe-node (v14 through v22.0.0) reports process.version as lang_version inside the JSON X-Stripe-Client-User-Agent header. In workerd that value is a fixed, stale Node version (v22.19.0), so Stripe reads it and emails app owners that their Node runtime is affected by CVE-2026-111497. This PR makes the functions-compiler shim strip only the lang_version field from that header on outbound requests, leaving every other field and process.version itself untouched.

Related Issue

None (reported via Slack — see attribution line on the original PR body)

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Other (please describe):

Changes Made

• Added stripStripeLangVersion() to packages/functions-compiler/src/static-egress.ts: parses the X-Stripe-Client-User-Agent header as JSON and, when it is a plain object containing lang_version, re-serializes it without that key.
• Wired the strip step as the first thing createRequestScopedStaticEgressFetch() does, so it applies to all three routes (ordinary fetch, excluded hosts, and the dedicated static-egress binding) and to actors.
• Matching is on header presence rather than hostname, so custom/proxied Stripe hosts are covered; headers that are not JSON objects, or that lack lang_version, are passed through byte-for-byte with the original input/init identity preserved.
• Handles both header locations: init.headers and headers carried on a Request object (the latter is rebuilt via new Request(input, { headers })).
• Unit tests in test/static-egress.test.ts covering init headers, Request headers, pass-through cases (non-JSON, already-stripped object, JSON array), and the dedicated-egress route.
• New e2e test test/stripe-user-agent.e2e.test.ts that bundles npm:stripe@20.4.1, runs it in workerd against a local echo server, and asserts the received user-agent header has no lang_version while retaining bindings_version, lang, and platform.

Testing

• I have tested these changes locally
• I have added/updated tests as needed
• All tests pass (`npm test`)

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (if applicable)
• My changes generate no new warnings
• I have updated `docs/` (AGENTS.md) if I made architectural changes

Additional Notes

• The fix is deliberately narrow: it does not patch `process.version` and does not touch any other telemetry field Stripe collects, so Stripe-side analytics keep working.
• Reaching live apps requires a new `@base44/functions-compiler` release (for apper's bundler pin) plus the CLI preview/release for the sandbox publish lane.
• No `docs/` update: this is a behavior fix inside the existing egress-fetch wrapper, not an architectural change.
• The full test suite was not re-run in this analysis environment; the e2e workerd test needs a workerd-capable runner.

---

_{🤖 Generated by Claude | 2026-10-23 15:02 UTC | 83d8553}

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.2.2-pr.676.83d8553

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.2.2-pr.676.83d8553"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.2.2-pr.676.83d8553"
  }
}

• 📦 Preview Package: @base44-preview/cli@0.2.2-pr.676.83d8553
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}