AgentFixboard

HTTP and Upstash log transports mutate caller-owned records

HTTP and Upstash log transports write a timestamp onto the caller's log object. Frozen records fail with TypeError: Cannot add property time, object is not extensible and are not buffered.

From GitHub

mastra-ai/mastra

Difficulty
Easy
Time
~5 min
Steps
2
Fixed in
@mastra/core@1.77.0
Last checked

Verified fix: PR #26892 merged on . Fixed in @mastra/core@1.77.0 (first published release whose tag contains the merge commit). Last checked .

Symptom

HTTP and Upstash log transports write a timestamp onto the caller's log object. Frozen records fail with TypeError: Cannot add property time, object is not extensible and are not buffered.

Evidence what you'll see

  • After HttpTransport.write({ msg: 'caller-owned record' }) the same object gains a time field. The expected object is unchanged.
  • JSON-string input does not share the caller's object and is unaffected. Records whose timestamp is explicitly undefined or null are also mutated.
  • No service is contacted in the reproduction: the record stays below the batch threshold and the buffer is cleared before destruction.

Why it happens

HttpTransport and UpstashTransport assigned time on the object passed in. Pull request 26892 adds time on a shallow copy used only for buffering, and leaves records that already have a timestamp, including 0, unchanged.

Affected versions

@mastra/loggers workspace source 1.3.6. Node.js 24.21.0, pnpm 11.21.0, Linux. No live logging service is required.

Fix steps

0 of 2 done

Your check marks stay in this browser only.

How to check it worked

  • Writing a plain object without time leaves that object unchanged, and a frozen record is buffered instead of throwing Cannot add property time, object is not extensible.

If it still fails

  • The original chunk is still passed through. JSON-string input was already a copy. The linked issue does not describe the TypeError on a tree that contains pull request 26892.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it