You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2024/01/19 20:05:06 UTC
[PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
rusackas opened a new pull request, #26693:
URL: https://github.com/apache/superset/pull/26693
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
### SUMMARY
<!--- Describe the change below, including rationale and design decisions -->
Just thought this was worth a shot to see if it can pass CI. This removes our dependency warnings from:
(37 moderate, 33 high, 14 critical)
to
(31 moderate, 28 high, 1 critical)
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
Good luck, CI.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1901038658
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/26693?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Comparison is base [(`3acda14`)](https://app.codecov.io/gh/apache/superset/commit/3acda145f1d15bb93db2dcbaf1f283b4b9840e8c?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 69.48% compared to head [(`49aeeff`)](https://app.codecov.io/gh/apache/superset/pull/26693?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) 56.64%.
> Report is 1 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #26693 +/- ##
===========================================
- Coverage 69.48% 56.64% -12.84%
===========================================
Files 1892 1892
Lines 74107 74107
Branches 8254 8254
===========================================
- Hits 51490 41975 -9515
- Misses 20541 30056 +9515
Partials 2076 2076
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.41% <ø> (-26.64%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/26693/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.41% <ø> (ø)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/26693?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1901044391
It seems this is mostly blocked by typescript problems... this might be fixable, which would be fantastic from a security perspective.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #26693:
URL: https://github.com/apache/superset/pull/26693
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946443455
Rekindling this effort, now that storybook is in. This will probably break a whole slew of things, but I'll try to patch what I spot...
Here's the good news, if we can pull this off:
<img width="406" alt="image" src="https://github.com/apache/superset/assets/812905/6105fbd6-e4fc-4b05-b961-ce8229c7d99c">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "michael-s-molina (via GitHub)" <gi...@apache.org>.
michael-s-molina commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946935048
> If we're willing to kill off some charts that have no replacement due to package vulnerabilities, we can take that route, but it sure seems like it'd need official consensus, and that ship has sailed for 4.0.
Yep, that would have been a great 4.0 proposal 😢 I do think we should do that in 5.0 though given the security implications.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946754013
@mistercrunch @michael-s-molina this finally passed CI! With this, `vm2` is the only critical dependency, but removing it is a breaking change (killing JS tooltips) so we'll have to punt that to 5.0.
This will need testing, so I'm spinning up a test environment. I'm most worried about things that use Airbnb dependencies (data-ui, visx, vx) since those are not well maintained, and their use is not well tested. Legacy charts that use them may be quietly broken by this PR. Let me know if you want to join in on the testing effort, and we can coordinate a bit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946774070
Now I'm curious to pull this branch and run `npm audit`, this is great progress! Now if we can fix https://github.com/apache/superset/pull/26944 on the Python side we'll be golden
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946744027
/testenv up
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946797308
Hmm... I thought ephemerals were working again... 😞
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
mistercrunch commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1917621620
<img width="784" alt="Screenshot 2024-01-30 at 10 11 07 AM" src="https://github.com/apache/superset/assets/487433/d390b720-a8c5-49ad-bd05-86cd7803ae23">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed pull request #26693: chore(hail mary): Update package-lock.json via npm-audit-fix
URL: https://github.com/apache/superset/pull/26693
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1946795291
Tempting as it is, I won't click merge yet... I _strongly suspect_ this PR breaks some charts, and they won't be easily fixable without some pretty deep rewrites... particularly the histogram.
If we're willing to kill off some charts that have no replacement due to package vulnerabilities, we can take that route, but it sure seems like it'd need official consensus, and that ship has sailed for 4.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1947088535
Impacted things to test:
* Sparkline cell (Timeseries Table)
* Histogram
* _...and more?_
Results:
Histogram seems to work (even if it _is_ giving me the finger)
<img width="1407" alt="image" src="https://github.com/apache/superset/assets/812905/4e79166d-d034-427c-b4cd-2813dda4dadc">
Sparkline seems to work, too!
<img width="1403" alt="image" src="https://github.com/apache/superset/assets/812905/d7758bad-93f5-42e3-a9b8-de3295d53fa7">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(hail mary): Update package-lock.json via npm-audit-fix [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #26693:
URL: https://github.com/apache/superset/pull/26693#issuecomment-1947092868
I think the data-ui problem I was thinking of was part of the React 17 upgrade effort, and this PR doesn't break it. I'll merge this if/when CI passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org