[
https://issues.apache.org/jira/browse/ATLAS-5384?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5384:
-----------------------------------
Description:
{*}Description:{*}*
The legacy `dashboardv2` module requires dependency upgrades to address
outdated sub-packages and close open Dependabot pull requests.
Because `dashboardv2` is tied to the older npm v6 build environment via Maven,
attempting to upgrade deeply nested sub-dependencies using manual `resolutions`
or `overrides` is either unsupported or ineffective.
Rather than using workarounds to force sub-dependency upgrades, this ticket
aims to cleanly resolve the outdated dependencies by upgrading their top-level
parent build tools in `package.json`. The changes include:
1. *{*}Upgrading core Grunt plugins to pull in secure sub-dependencies:{*}*
* Upgraded `grunt` to `^1.6.3` (This inherently pulls in the modernized
version of `micromatch` to resolve the `picomatch` alerts).
* Upgraded `grunt-contrib-connect` to `^5.0.1` (This inherently pulls in the
modernized versions of `serve-static` and `send`).
2. *{*}Cleaning up dependencies:{*}*
* Removed ineffective `overrides`/`resolutions` blocks from `package.json` to
rely entirely on native, safe npm dependency resolution.
3. *{*}Lockfile Generation:{*}*
* Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the
strictly enforced Node v12.16.0 / npm v6.13.7 environment to ensure the Maven
build remains stable and developers can continue running `npm install` locally
without lockfile conflicts.
This effort cleanly modernizes the build pipeline for `dashboardv2` and will
consolidate and close the following open Dependabot PRs for the dashboard
module:
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
was:
The legacy dashboardv2 module requires several dependency upgrades to address
outdated packages and open Dependabot pull requests.
Because dashboardv2 is tied to the older npm v6 build environment via Maven,
upgrading deeply nested sub-dependencies (like those within Grunt build tools)
requires additional configuration.
This ticket aims to modernize the dependency tree by doing the following:
1. Applying `npm audit fix` to automatically bump vulnerable sub-dependencies
(such as `websocket-driver`, `brace-expansion`, and `picomatch`) to their
latest compatible versions.
2. Introducing the `npm-force-resolutions` tool via a preinstall script to
allow for safe, manual upgrades of stubborn nested dev-dependencies.
3. Manually overriding and upgrading the following nested build tools via the
`resolutions` block in `package.json`:
* `underscore` to 1.13.8
* `lodash` to 4.18.1
* `d3-color` to 3.1.0
* `js-yaml` to 4.1.0
* `immutable` to 5.1.9
* `minimatch` to 3.1.4
* `clean-css` to 5.3.3
* `html-minifier` to 4.0.0
* `trim-newlines` to 4.1.1
4. Regenerating a clean `package-lock.json` using the required Node v12.16.0 /
npm v6.13.7 environment.
This effort will also consolidate and close the following open Dependabot PRs
for both `dashboardv2` and `dashboardv2/public/js/external_lib/atlas-lineage`:
* PR #629 (@babel/plugin-transform-modules-systemjs)
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #561 (serialize-javascript, webpack)
* PR #255 (elliptic)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
> Atlas Classic UI: Upgrade UI dependencies for dashboardv2
> ---------------------------------------------------------
>
> Key: ATLAS-5384
> URL: https://issues.apache.org/jira/browse/ATLAS-5384
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 3.0.0, 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
>
> {*}Description:{*}*
> The legacy `dashboardv2` module requires dependency upgrades to address
> outdated sub-packages and close open Dependabot pull requests.
> Because `dashboardv2` is tied to the older npm v6 build environment via
> Maven, attempting to upgrade deeply nested sub-dependencies using manual
> `resolutions` or `overrides` is either unsupported or ineffective.
> Rather than using workarounds to force sub-dependency upgrades, this ticket
> aims to cleanly resolve the outdated dependencies by upgrading their
> top-level parent build tools in `package.json`. The changes include:
> 1. *{*}Upgrading core Grunt plugins to pull in secure sub-dependencies:{*}*
> * Upgraded `grunt` to `^1.6.3` (This inherently pulls in the modernized
> version of `micromatch` to resolve the `picomatch` alerts).
> * Upgraded `grunt-contrib-connect` to `^5.0.1` (This inherently pulls in the
> modernized versions of `serve-static` and `send`).
> 2. *{*}Cleaning up dependencies:{*}*
> * Removed ineffective `overrides`/`resolutions` blocks from `package.json`
> to rely entirely on native, safe npm dependency resolution.
> 3. *{*}Lockfile Generation:{*}*
> * Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the
> strictly enforced Node v12.16.0 / npm v6.13.7 environment to ensure the Maven
> build remains stable and developers can continue running `npm install`
> locally without lockfile conflicts.
> This effort cleanly modernizes the build pipeline for `dashboardv2` and will
> consolidate and close the following open Dependabot PRs for the dashboard
> module:
> * PR #588 (picomatch)
> * PR #579 (picomatch)
> * PR #254 (serve-static)
> * PR #253 (send, serve-static)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
