michael-s-molina opened a new pull request, #42804: URL: https://github.com/apache/superset/pull/42804
### SUMMARY Reverts the `simple-zstd` 1.4.2 → 2.1.0 bump for the second time, and this time adds a dependabot ignore rule so it doesn't come back a third time. **History:** - #38662 bumped `simple-zstd` from 1.4.2 to 2.1.0 (dependabot). 2.0.0 is a breaking release: `ZSTDDecompress` was renamed to `decompress` and made async (returns `Promise<stream>` instead of a stream). - #39138 attempted an in-place fix (`await`-ing the new async `decompress()` in `webpack.proxy-config.js`), but `npm run dev-server` was still freezing when navigating between pages. - #39139 reverted the bump back to 1.4.2 to restore a working dev proxy. - #39369 was dependabot reopening the exact same 1.4.2 → 2.1.0 bump. This time it shipped with the `webpack.proxy-config.js` async fix baked in and merged, reintroducing the same underlying breakage that #39139 had reverted. This PR reverts both `superset-frontend/package.json`/`package-lock.json` (`simple-zstd` back to `^1.4.2`) and `superset-frontend/webpack.proxy-config.js` (back to the synchronous `ZSTDDecompress()` API), matching the state #39139 restored. **Preventing a third bump:** the previous revert had no mechanism to stop dependabot from proposing the same upgrade again, which is exactly what happened in #39369. `package.json` is parsed as strict JSON, so it has no comment syntax to leave a "don't bump this" note on the dependency line — and even a non-standard `"//"` key would do nothing functional, since dependabot only reads ignore rules from `.github/dependabot.yml`, not from `package.json`. This PR adds a `dependency-name: "simple-zstd"` entry to the existing `ignore` list in `.github/dependabot.yml` (following the same pattern already used there for `@deck.gl/*`, `@babel/*`, etc.), with a comment explaining why and what needs to happen before it can be removed. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A ### TESTING INSTRUCTIONS 1. Run `npm ci` in `superset-frontend/` 2. Start the Superset backend 3. Run `npm run dev-server` 4. Navigate between pages — no freezing or proxy errors 5. Confirm dependabot no longer proposes a `simple-zstd` version bump (enforced via `.github/dependabot.yml`, not directly testable locally) ### ADDITIONAL INFORMATION - [x] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
