[
https://issues.apache.org/jira/browse/ATLAS-5384?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5384:
-----------------------------------
Description:
*Title:* Upgrade legacy Grunt build tools in dashboardv2 to close Dependabot
PRs and Vulnerabilities
*Description:*
The legacy `dashboardv2` module requires dependency upgrades to address
outdated sub-packages and close open Dependabot pull requests.
Because `dashboardv2` is tied to the older npm v6 build environment via Maven,
attempting to upgrade deeply nested sub-dependencies using manual `resolutions`
or `overrides` is either unsupported or ineffective.
Rather than using workarounds to force sub-dependency upgrades, this ticket
aims to cleanly resolve the outdated dependencies by safely upgrading their
top-level parent build tools in `package.json`. The changes include:
1. *Upgrading core Grunt plugins to pull in secure sub-dependencies:*
* Upgraded `grunt` to `^1.6.3` (Inherently pulls in the modernized version of
`micromatch` to resolve the `picomatch` alerts).
* Upgraded `grunt-contrib-connect` to `^5.0.1` (Inherently pulls in the
modernized versions of `serve-static` and `send`).
* Upgraded `grunt-contrib-cssmin` to `^4.0.0` (Inherently resolves the nested
`clean-css` and `trim-newlines` vulnerabilities while retaining Node 12
compatibility).
2. *Cleaning up dependencies:*
* Removed ineffective `overrides`/`resolutions` blocks from `package.json` to
rely entirely on native, safe npm dependency resolution.
3. *Lockfile Generation:*
* Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the
strictly enforced Node v12.16.0 / npm v6.13.7 environment to ensure the Maven
build remains stable and developers can continue running `npm install` locally
without lockfile conflicts.
This effort cleanly modernizes the build pipeline for `dashboardv2` and will
consolidate and close the following open Dependabot PRs and audit
vulnerabilities for the dashboard module:
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
* NPM Audit fixes for `clean-css` and `trim-newlines`.
was:
{*}Description:{*}*
The legacy `dashboardv2` module requires dependency upgrades to address
outdated sub-packages and close open Dependabot pull requests.
Because `dashboardv2` is tied to the older npm v6 build environment via Maven,
attempting to upgrade deeply nested sub-dependencies using manual `resolutions`
or `overrides` is either unsupported or ineffective.
Rather than using workarounds to force sub-dependency upgrades, this ticket
aims to cleanly resolve the outdated dependencies by upgrading their top-level
parent build tools in `package.json`. The changes include:
1. *{*}Upgrading core Grunt plugins to pull in secure sub-dependencies:{*}*
* Upgraded `grunt` to `^1.6.3` (This inherently pulls in the modernized
version of `micromatch` to resolve the `picomatch` alerts).
* Upgraded `grunt-contrib-connect` to `^5.0.1` (This inherently pulls in the
modernized versions of `serve-static` and `send`).
2. *{*}Cleaning up dependencies:{*}*
* Removed ineffective `overrides`/`resolutions` blocks from `package.json` to
rely entirely on native, safe npm dependency resolution.
3. *{*}Lockfile Generation:{*}*
* Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the
strictly enforced Node v12.16.0 / npm v6.13.7 environment to ensure the Maven
build remains stable and developers can continue running `npm install` locally
without lockfile conflicts.
This effort cleanly modernizes the build pipeline for `dashboardv2` and will
consolidate and close the following open Dependabot PRs for the dashboard
module:
* PR #588 (picomatch)
* PR #579 (picomatch)
* PR #254 (serve-static)
* PR #253 (send, serve-static)
> Atlas Classic UI: Upgrade UI dependencies for dashboardv2
> ---------------------------------------------------------
>
> Key: ATLAS-5384
> URL: https://issues.apache.org/jira/browse/ATLAS-5384
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 3.0.0, 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
>
> *Title:* Upgrade legacy Grunt build tools in dashboardv2 to close Dependabot
> PRs and Vulnerabilities
> *Description:*
> The legacy `dashboardv2` module requires dependency upgrades to address
> outdated sub-packages and close open Dependabot pull requests.
> Because `dashboardv2` is tied to the older npm v6 build environment via
> Maven, attempting to upgrade deeply nested sub-dependencies using manual
> `resolutions` or `overrides` is either unsupported or ineffective.
> Rather than using workarounds to force sub-dependency upgrades, this ticket
> aims to cleanly resolve the outdated dependencies by safely upgrading their
> top-level parent build tools in `package.json`. The changes include:
> 1. *Upgrading core Grunt plugins to pull in secure sub-dependencies:*
> * Upgraded `grunt` to `^1.6.3` (Inherently pulls in the modernized version
> of `micromatch` to resolve the `picomatch` alerts).
> * Upgraded `grunt-contrib-connect` to `^5.0.1` (Inherently pulls in the
> modernized versions of `serve-static` and `send`).
> * Upgraded `grunt-contrib-cssmin` to `^4.0.0` (Inherently resolves the
> nested `clean-css` and `trim-newlines` vulnerabilities while retaining Node
> 12 compatibility).
> 2. *Cleaning up dependencies:*
> * Removed ineffective `overrides`/`resolutions` blocks from `package.json`
> to rely entirely on native, safe npm dependency resolution.
> 3. *Lockfile Generation:*
> * Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the
> strictly enforced Node v12.16.0 / npm v6.13.7 environment to ensure the Maven
> build remains stable and developers can continue running `npm install`
> locally without lockfile conflicts.
> This effort cleanly modernizes the build pipeline for `dashboardv2` and will
> consolidate and close the following open Dependabot PRs and audit
> vulnerabilities for the dashboard module:
> * PR #588 (picomatch)
> * PR #579 (picomatch)
> * PR #254 (serve-static)
> * PR #253 (send, serve-static)
> * NPM Audit fixes for `clean-css` and `trim-newlines`.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
