wangzhigang1999 opened a new issue, #7533: URL: https://github.com/apache/kyuubi/issues/7533
### Why do we need to upgrade? Common Vulnerabilities and Exposures (CVE), plus regular toolchain modernization. The `kyuubi-server/web-ui` build/test toolchain is several majors behind and partly end-of-life (vite 4.5, vitest 0.32, @vitejs/plugin-vue 4, vue-tsc 0.38, TypeScript 4.6). Dependabot also has ~11 open security-update PRs against the module, and there are production-path advisories (vue-i18n, lodash) those individual bumps do not cover. Rather than merging 11 piecemeal PRs, this consolidates them and modernizes the toolchain in one coherent change. ### Artifact `kyuubi-server/web-ui` build toolchain and runtime dependencies. ### Target versions - Build/test: vite 4.5→8, vitest + @vitest/coverage-v8 0.32→4, @vitejs/plugin-vue 4→6, vue-tsc 0.38→3.3, TypeScript 4.6→5.9, jsdom 20→26, sass→1.101, @types/node→22. - Runtime (security): vue-i18n 9.2→9.14.5, element-plus 2.2→2.14, lodash/lodash-es→4.18.1 (pnpm overrides). - CI Node baseline: `node.version` v20.17→v22.23.1 (required by vite 8). ### Notable changes - vite 8 switches its bundler to rolldown; the workflows derive the Node version from the `node.version` Maven property, so no workflow-file edits are needed. - `pnpm audit --prod` goes from 3 high / 7 moderate to 0 vulnerabilities. - Small code changes surfaced by the upgrade: element-plus `TabPanelName`→`TabPaneName` rename, and missing required props on the overview placeholder card (vue-tsc 3 strictness). - The unused, drifting `package-lock.json` is removed — the module builds with pnpm (`pnpm-lock.yaml`). - ESLint 8→9 (flat-config) and its dev-only transitive advisories (js-yaml/ajv/flatted/minimatch) are deferred to a follow-up PR. ### Willing to submit a PR? Yes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
