[
https://issues.apache.org/jira/browse/ATLAS-5316?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18088162#comment-18088162
]
ASF subversion and git services commented on ATLAS-5316:
--------------------------------------------------------
Commit d8232d1cce37359fdb07d061118696eff13eb944 in atlas's branch
refs/heads/master from Prasad Pawar
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=d8232d1cc ]
ATLAS-5316: ATLAS UI: Dependency version uplift for Atlas React dashboard and
documentation site (#667)
> ATLAS UI: Dependency version uplift for Atlas React dashboard and
> documentation site
> ------------------------------------------------------------------------------------
>
> Key: ATLAS-5316
> URL: https://issues.apache.org/jira/browse/ATLAS-5316
> Project: Atlas
> Issue Type: Bug
> Components: atlas-webui
> Affects Versions: 3.0.0
> Reporter: Prasad P. Pawar
> Assignee: Prasad P. Pawar
> Priority: Major
> Time Spent: 10m
> Remaining Estimate: 0h
>
> This work updates direct and transitive npm dependencies in
> {{dashboard/package.json}} and {{docs/package.json}} (including {{overrides}}
> and lockfiles) to align with upstream recommended releases. The goal is
> improved dependency hygiene, consistent transitive resolution, and alignment
> with current library maintenance guidance—without changing application source
> code.
> ----
> h3. Scope
> ||Module||Files updated||
> |React Dashboard|{{{}dashboard/package.json{}}},
> {{dashboard/package-lock.json}}|
> |Documentation site|{{{}docs/package.json{}}}, {{docs/package-lock.json}}|
> |Existing docz patches
> (unchanged)|{{{}docs/patches/html-minifier+4.0.0.patch{}}},
> {{docs/patches/http-proxy-middleware+0.19.1.patch}}|
> ----
> h3. Dependency change matrix
> ||Package||Module||Previous version||Updated version||Change type||Why this
> change||Where used in Atlas||Version difference (high level)||Project impact||
> |axios|dashboard|1.15.2|1.16.0|Direct dependency + {{overrides}}|Align HTTP
> client with latest stable 1.x release; improves proxy/redirect handling and
> adapter consistency|{{dashboard/src/api/apiMethods/fetchApi.ts}} (main API
> calls); type imports in {{{}QuickSearch.tsx{}}}, {{{}Labels.tsx{}}},
> {{FormAutocomplete.tsx}}|Improved redirect header handling, proxy credential
> handling, IPv6 hostname normalization in proxy rules; no public API
> renames|Low — browser XHR adapter unchanged for normal UI flows; build and 38
> fetchApi unit tests pass|
> |axios|docs|1.15.2|1.16.0|devDependency + {{overrides}}|Same HTTP client
> alignment for docs tooling|{{docs/theme/components/shared/TeamList/index.js}}
> ({{{}axios.get{}}} for team list fetch)|Same as dashboard row|Low — simple
> GET usage only|
> |handlebars|dashboard|4.7.8 (transitive via ts-jest)|4.7.9|{{overrides}}
> only|Pin transitive template engine to latest 4.7.x patch|Not used in app
> source — only {{ts-jest}} CLI ({{{}config:init{}}} Jest config template
> generation)|Internal compiler/runtime hardening; stricter AST handling; no
> method renames|None — no imports in dashboard source|
> |@babel/preset-env|dashboard|7.28.5|7.29.5|devDependency|Brings updated Babel
> preset used by Jest test pipeline|Jest/Babel test compilation (no runtime UI
> usage)|Updated preset bundle; pulls patched systemjs transform plugin|None —
> tests compile as before|
> |@babel/plugin-transform-modules-systemjs|dashboard|7.28.5
> (transitive)|7.29.4|{{overrides}}|Align transitive Babel plugin with
> preset-env 7.29.5|Transitive via {{{}@babel/preset-env{}}}; dashboard does
> not use {{modules: "systemjs"}}|Safer handling of untrusted module input
> during compile|None — trusted test/build code only|
> |shell-quote|docs|1.7.3|1.8.4|{{overrides}}|Replace previously pinned older
> transitive version with current stable release|Transitive via {{docz}} →
> {{react-dev-utils}} → {{shell-quote.parse()}} on {{REACT_EDITOR}} env var
> (docz dev tooling only)|{{quote()}} validates object-token shapes strictly;
> {{parse()}} behavior unchanged for string inputs|None — not imported in docs
> source|
> |html-minifier|docs|3.5.21 / 4.0.0 (mixed transitive)|4.0.0 (unified) +
> existing patch|{{overrides}} + {{patch-package}}|Consolidate to single
> version; apply existing local patch for regex performance
> hardening|Transitive via {{docz}} / {{docz-core}} (docs site
> build/minification only)|Override removes nested 3.5.21; patch limits regex
> repetition in minifier|Low — docs build-time only; patch already applied on
> postinstall|
> |http-proxy-middleware|docs|0.19.1|0.19.1 (unchanged version)|Existing
> {{patch-package}} patch|docz/webpack-dev-server requires 0.19.x; no
> compatible major upgrade without replacing docz|Transitive via {{docz}} →
> {{webpack-dev-server}} (docs dev server only)|Patch wraps micromatch calls to
> avoid unhandled rejection during dev|None for dashboard; docs dev server only|
> |tmp|docs|0.0.33 (transitive via patch-package)|0.2.6|{{overrides}}|Align
> temp-file helper to maintained release|Transitive via {{patch-package}}
> postinstall (docs tooling)|Improved path handling in temp file creation
> APIs|None — patch-package uses fixed trusted prefixes|
>
> ----
> h3. package.json changes detail
> h4. dashboard/package.json
> ||Section||Field||Before||After||
> |dependencies|{{axios}}|1.15.2|1.16.0|
> |devDependencies|{{@babel/preset-env}}|7.28.5|7.29.5|
> |overrides|{{handlebars}}|(not set)|4.7.9|
> |overrides|{{axios}}|(not set)|1.16.0|
> |overrides|{{@babel/plugin-transform-modules-systemjs}}|(not set)|7.29.4|
> h4. docs/package.json
> ||Section||Field||Before||After||
> |devDependencies|{{axios}}|1.15.2|1.16.0|
> |overrides|{{shell-quote}}|1.7.3|1.8.4|
> |overrides|{{axios}}|1.15.2|1.16.0|
> |overrides|{{html-minifier}}|(not set)|4.0.0|
> |overrides|{{tmp}}|(not set)|0.2.6|
> ----
> h3. Application code impact assessment
> ||Area||Code changes required?||Notes||
> |Dashboard UI / API layer|No|axios public API unchanged ({{{}get{}}},
> {{{}post{}}}, {{{}isAxiosError{}}}, {{{}AxiosRequestConfig{}}})|
> |Dashboard unit tests|No|Jest/Babel pipeline updated; all fetchApi tests pass|
> |Docs site theme|No|TeamList axios usage unchanged|
> |Docs build / dev server|No|Existing patch-package patches continue to apply
> on {{npm install}}|
> |Classic UI (dashboardv2)|Out of scope|Bundled Handlebars 4.7.8 in
> {{dashboardv2/public/js/external_lib/}} is separate from npm overrides|
> ----
> h3. Verification completed
> ||Check||Result||
> |{{dashboard}} production build|Passed|
> |{{fetchApi}} unit tests (38)|Passed|
> |ESLint|No new errors from dependency changes (4 pre-existing errors in
> untracked cypress files)|
> |Resolved versions ({{{}npm ls{}}})|axios 1.16.0, handlebars 4.7.9,
> shell-quote 1.8.4, tmp 0.2.6, html-minifier 4.0.0|
> ----
> h3. Out of scope / follow-up
> ||Item||Reason||
> |Replace docz / webpack-dev-server stack|Required for native
> {{http-proxy-middleware}} 2.x upgrade; current 0.19.1 patch mitigates
> dev-server behavior|
> |Upgrade dashboardv2 bundled Handlebars|Separate legacy UI bundle, not
> managed by dashboard npm lockfile|
> ----
> h3. Acceptance criteria
> * {{dashboard/package.json}} and {{dashboard/package-lock.json}} updated as
> per table above
> * {{docs/package.json}} and {{docs/package-lock.json}} updated as per table
> above
> * Dashboard build succeeds
> * Dashboard fetchApi tests pass
> * Docs {{npm install}} applies existing patches successfully
> * No application source code changes required
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
