[
https://issues.apache.org/jira/browse/ATLAS-5384?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5384:
-----------------------------------
Description:
The legacy dashboardv2 module requires several dependency upgrades to address
outdated packages and open Dependabot pull requests.
Because dashboardv2 is tied to the older npm v6 build environment via Maven,
upgrading deeply nested sub-dependencies (like those within Grunt build tools)
requires additional configuration.
This ticket aims to modernize the dependency tree by doing the following:
1. Applying `npm audit fix` to automatically bump vulnerable sub-dependencies
(such as `websocket-driver`, `brace-expansion`, and `picomatch`) to their
latest compatible versions.
2. Introducing the `npm-force-resolutions` tool via a preinstall script to
allow for safe, manual upgrades of stubborn nested dev-dependencies.
3. Manually overriding and upgrading the following nested build tools via the
`resolutions` block in `package.json`:
* `underscore` to 1.13.8
* `lodash` to 4.18.1
* `d3-color` to 3.1.0
* `js-yaml` to 4.1.0
* `immutable` to 5.1.9
* `minimatch` to 3.1.4
* `clean-css` to 5.3.3
* `html-minifier` to 4.0.0
* `trim-newlines` to 4.1.1
4. Regenerating a clean `package-lock.json` using the required Node v12.16.0 /
npm v6.13.7 environment.
This effort will also consolidate and close the following open Dependabot PRs
for both `dashboardv2` and `dashboardv2/public/js/external_lib/atlas-lineage`:
* PR #629 (@babel/plugin-transform-modules-systemjs)
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #561 (serialize-javascript, webpack)
* PR #255 (elliptic)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
was:
The legacy dashboardv2 module requires several dependency upgrades to address
outdated packages and open Dependabot pull requests.
Because dashboardv2 is tied to the older npm v6 build environment via Maven,
upgrading deeply nested sub-dependencies (like those within Grunt build tools)
requires additional configuration.
This ticket aims to:
1. Introduce the `npm-force-resolutions` tool via a preinstall script to allow
for safe upgrades of nested dependencies.
2. Upgrade top-level and nested dependencies in both `dashboardv2` and
`dashboardv2/public/js/external_lib/atlas-lineage`.
3. Regenerate a clean `package-lock.json` using the required Node v12.16.0 /
npm v6.13.7 environment.
This effort will also consolidate and close the following open Dependabot PRs:
* PR #629 (@babel/plugin-transform-modules-systemjs)
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #561 (serialize-javascript, webpack)
* PR #255 (elliptic)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
> Atlas Classic UI: Upgrade UI dependencies for dashboardv2
> ---------------------------------------------------------
>
> Key: ATLAS-5384
> URL: https://issues.apache.org/jira/browse/ATLAS-5384
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 3.0.0, 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
>
> The legacy dashboardv2 module requires several dependency upgrades to address
> outdated packages and open Dependabot pull requests.
> Because dashboardv2 is tied to the older npm v6 build environment via Maven,
> upgrading deeply nested sub-dependencies (like those within Grunt build
> tools) requires additional configuration.
> This ticket aims to modernize the dependency tree by doing the following:
> 1. Applying `npm audit fix` to automatically bump vulnerable sub-dependencies
> (such as `websocket-driver`, `brace-expansion`, and `picomatch`) to their
> latest compatible versions.
> 2. Introducing the `npm-force-resolutions` tool via a preinstall script to
> allow for safe, manual upgrades of stubborn nested dev-dependencies.
> 3. Manually overriding and upgrading the following nested build tools via the
> `resolutions` block in `package.json`:
> * `underscore` to 1.13.8
> * `lodash` to 4.18.1
> * `d3-color` to 3.1.0
> * `js-yaml` to 4.1.0
> * `immutable` to 5.1.9
> * `minimatch` to 3.1.4
> * `clean-css` to 5.3.3
> * `html-minifier` to 4.0.0
> * `trim-newlines` to 4.1.1
> 4. Regenerating a clean `package-lock.json` using the required Node v12.16.0
> / npm v6.13.7 environment.
> This effort will also consolidate and close the following open Dependabot PRs
> for both `dashboardv2` and `dashboardv2/public/js/external_lib/atlas-lineage`:
> * PR #629 (@babel/plugin-transform-modules-systemjs)
> * PR #588 (picomatch)
> * PR #579 (picomatch)
> * PR #561 (serialize-javascript, webpack)
> * PR #255 (elliptic)
> * PR #254 (serve-static)
> * PR #253 (send, serve-static)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
