sadpandajoe commented on code in PR #43447:
URL: https://github.com/apache/superset/pull/43447#discussion_r3855659531
##########
.github/dependabot.yml:
##########
@@ -80,6 +80,11 @@ updates:
patterns:
- "ag-grid-react"
- "ag-grid-community"
+ swc:
+ patterns:
+ - "@swc/core"
+ - "@swc/plugin-emotion"
+ - "@swc/plugin-transform-imports"
Review Comment:
Because this package is still unconditionally ignored above, Dependabot will
exclude it from future `swc` group updates. That can leave the transform plugin
behind while the other SWC components advance, despite the group being intended
to keep this compatibility boundary together. Should the ignore be removed or
narrowed now that the package is being grouped?
##########
superset-frontend/package-lock.json:
##########
@@ -43073,15 +43091,6 @@
"node": ">=12"
}
},
- "packages/superset-ui-core/node_modules/dompurify": {
- "version": "3.4.13",
- "resolved":
"https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz";,
- "integrity":
"sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
- "license": "(MPL-2.0 OR Apache-2.0)",
- "optionalDependencies": {
- "@types/trusted-types": "^2.0.7"
- }
- },
"packages/superset-ui-core/node_modules/react-ace": {
Review Comment:
Removing the adjacent `@superset-ui/core` DOMPurify resolution leaves that
workspace's `^3.4.13` dependency satisfied only by the hoisted 3.4.12 entry. A
clean install can therefore reject or rewrite this lock graph. Could the 3.4.13
resolution be restored (or the DOMPurify update be made explicit)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
