Skip to content

fix(webapp): prevent OTLP nanosecond timestamp overflow (#3292) - #4376

Closed
marceli1404 wants to merge 1 commit into
triggerdotdev:mainfrom
marceli1404:fix/otlp-nanosecond-overflow
Closed

fix(webapp): prevent OTLP nanosecond timestamp overflow (#3292)#4376
marceli1404 wants to merge 1 commit into
triggerdotdev:mainfrom
marceli1404:fix/otlp-nanosecond-overflow

Conversation

@marceli1404

Copy link
Copy Markdown

Problem

Issue #3292: OTLP timestamps use nanoseconds. When converting epoch milliseconds to nanoseconds (\ms * 1_000_000), the result exceeds \Number.MAX_SAFE_INTEGER\ (~9 quadrillion), causing IEEE 754 floating-point precision loss. After \BigInt()\ wraps the already-corrupt value, the timestamp is silently wrong.

Fixes

All four HIGH-severity sites follow the same pattern: move \BigInt()\ before the multiplication so it happens in BigInt space.

File Before After
\common.server.ts:28\ \BigInt(new Date().getTime() * 1_000_000)\ \BigInt(Date.now()) * 1_000_000n\
\common.server.ts:42\ \BigInt(.getTime() * 1_000_000)\ \BigInt(.getTime()) * 1_000_000n\
\index.server.ts:243\ \BigInt((startTime?.getTime() ?? Date.now()) * 1_000_000)\ \BigInt(startTime?.getTime() ?? Date.now()) * 1_000_000n\
\
unEngineHandlers.server.ts:558\ \BigInt(time.getTime() * 1000000)\ \BigInt(time.getTime()) * 1_000_000n\

Also adds \�pochMsToNanoseconds()\ helper to \packages/core/src/v3/utils/durations.ts\ for safe epoch-level conversions, and fixes \seed-ai-spans.mts\ for consistency.

Closes #3292

…v#3292)

Move BigInt() before multiplication to avoid IEEE 754 precision loss
when converting epoch milliseconds to nanoseconds.

Fixes 4 overflow sites:
- getNowInNanoseconds(): BigInt(Date.now()) * 1_000_000n
- calculateDurationFromStart(): BigInt(getTime()) * 1_000_000n
- recordEvent() startTime: BigInt(getTime()) * 1_000_000n
- runEngineHandlers OOM retry: BigInt(getTime()) * 1_000_000n

Also adds epochMsToNanoseconds() helper to durations.ts for safe
epoch-level conversions, and fixes seed script consistency.
@github-actions

Copy link
Copy Markdown
Contributor

Hi @marceli1404, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

@github-actions github-actions Bot closed this Jul 26, 2026
@coderabbitai

coderabbitai Bot commented Jul 26, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 97c0172c-92c9-43bc-ba98-7de8b16a6362

📥 Commits

Reviewing files that changed from the base of the PR and between be45cf9 and 9d2f138.

📒 Files selected for processing (5)
  • apps/webapp/app/v3/eventRepository/common.server.ts
  • apps/webapp/app/v3/eventRepository/index.server.ts
  • apps/webapp/app/v3/runEngineHandlers.server.ts
  • apps/webapp/seed-ai-spans.mts
  • packages/core/src/v3/utils/durations.ts

Walkthrough

Nanosecond timestamp and duration calculations now convert millisecond values to BigInt before multiplying by the nanosecond scale. This applies to event repository timestamps, duration calculations, retry scheduling, and seeded AI span durations. A reusable epochMsToNanoseconds helper was also added to the core duration utilities.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Open in Devin Review

Comment on lines +35 to +38
/** Convert epoch milliseconds to nanoseconds using BigInt to avoid overflow. */
export function epochMsToNanoseconds(ms: number): bigint {
return BigInt(ms) * 1_000_000n;
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Public package changed without the required release-notes entry

A new function was added to the public core package (packages/core/src/v3/utils/durations.ts:36) without adding a changeset, which the repository rules require for any change to a published package.
Impact: The change to the published package will ship without an entry in the user-facing release notes, and CI/release tooling that enforces changesets may block the merge.

Repository rule requiring a changeset for public package changes

AGENTS.md states: "When modifying any public package (packages/* or integrations/*), add a changeset" via pnpm run changeset:add. CONTRIBUTING.md restates this: contributions to anything in /packages require a changeset before merge. This PR modifies packages/core/src/v3/utils/durations.ts (adding epochMsToNanoseconds) but the diff adds no file under .changeset/ — the only changeset present (.changeset/chat-agent-preserve-partial-on-stream-failure.md) is unrelated and pre-existing.

Prompt for agents
The PR adds a new exported function epochMsToNanoseconds to the public package packages/core/src/v3/utils/durations.ts, but no changeset accompanies the change. Per AGENTS.md and CONTRIBUTING.md, any modification to a public package under packages/* requires a changeset. Add a patch changeset (run pnpm run changeset:add, selecting @trigger.dev/core) with a user-facing description of the fix so the change appears in release notes.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

OTLP nanosecond timestamp overflow in webapp event repository

1 participant