voidmatcha opened a new pull request, #5303: URL: https://github.com/apache/zeppelin/pull/5303
### What is this PR for? This PR resolves CI/tooling issues tracked in ZEPPELIN-6538. First, GitHub Actions now warns that Node.js 20 action runtimes are deprecated and are being forced to run on Node.js 24. This PR updates the affected workflow actions in `core.yml`, `frontend.yml`, and `quick.yml` to Node 24 runtime versions. Second, `zeppelin-web-angular/projects/zeppelin-react` still reported npm audit findings from the `[email protected]` dependency tree. This PR updates `webpack-dev-server` from `5.2.4` to `6.0.0`, which removes the vulnerable `sockjs` / `uuid` transitive path and updates the dev-server dependency tree so `zeppelin-react` full `npm audit` reports zero vulnerabilities. It also makes the existing Spark Angular display implicit conversions explicit with `scala.language.implicitConversions`, avoiding Scala feature warnings in CI without changing the conversion behavior. ### What type of PR is it? Improvement ### Todos * [x] Update GitHub Actions to Node 24 runtime versions * [x] Update `zeppelin-react` `webpack-dev-server` to `6.0.0` * [x] Verify `zeppelin-react` full `npm audit` reports zero vulnerabilities * [x] Make Spark Angular display implicit conversions explicit ### What is the Jira issue? https://issues.apache.org/jira/browse/ZEPPELIN-6538 ### How should this be tested? Verified locally: ```bash cd zeppelin-web-angular/projects/zeppelin-react npm ci --ignore-scripts npm audit npm test -- --run npx webpack --config webpack.config.js --mode development --stats=errors-only ``` Results: * `npm audit`: 0 vulnerabilities * `npm test -- --run`: 2 files / 13 tests passed * webpack development build: exit 0 Also verified: ```bash cd zeppelin-web-angular npm ci --ignore-scripts npm run build:react cd .. git diff --check go run github.com/rhysd/actionlint/cmd/actionlint@latest -shellcheck= .github/workflows/core.yml .github/workflows/frontend.yml .github/workflows/quick.yml ``` Notes: * Spark compile verification was blocked locally by a linked-worktree `git-commit-id-plugin` issue before reaching Spark compilation. CI should verify the Spark paths that reported the feature warning. * Live `npm run dev` HTTP smoke was not run locally because the local session hook blocks starting dev servers. ### Screenshots (if appropriate) N/A ### Questions: * Does the license files need to update? No. * Is there breaking changes for older versions? No runtime behavior change is intended. `[email protected]` requires Node.js `>=22.15.0`, and `zeppelin-web-angular/.nvmrc` already uses Node `22.21.1`. * Does this needs documentation? No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
