You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "spuru9 (via GitHub)" <gi...@apache.org> on 2026/09/07 18:19:49 UTC
[PR] [FLINK-40590][runtime-web] Update Angular and monaco-editor to latest patch versions [flink]
spuru9 opened a new pull request, #29126:
URL: https://github.com/apache/flink/pull/29126
## What is the purpose of the change
Bring `flink-runtime-web/web-dashboard`'s npm dependencies up to date — several packages in the dependency tree have `npm audit` findings that are resolved in newer releases.
## Brief change log
- Bump `@angular/*` (animations, common, compiler, core, forms, platform-browser, platform-browser-dynamic, router, build, compiler-cli) from 21.2.17 to 21.2.22
- Bump `monaco-editor` from 0.55.1 to 0.56.0 (latest available), which also updates its bundled `dompurify`
- Run `npm audit fix` to update remaining fixable transitive dev-tooling dependencies
- Regenerate `flink-runtime-web/src/main/resources/META-INF/NOTICE` to match the new dependency versions
- One transitive dependency bundled by `monaco-editor` can't be fully updated until its next upstream release; will revisit then
## Verifying this change
This change is already covered by existing tests. Verified with `npm run ci-check` (lint, unit tests, production build) in `flink-runtime-web/web-dashboard`, all passing.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): yes (npm dependencies only, no Java/Maven dependency changes)
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: no
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (claude-sonnet-5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-40590][runtime-web] Update Angular and monaco-editor to latest available versions [flink]
Posted by "MartijnVisser (via GitHub)" <gi...@apache.org>.
MartijnVisser commented on PR #29126:
URL: https://github.com/apache/flink/pull/29126#issuecomment-5581999854
The override doesn't change what we ship. The dashboard copies monaco's prebuilt min/vs into assets/vs, and that bundle has DOMPurify 3.4.8 vendored inline; monaco never imports the npm dompurify package, so the 3.4.15 in node_modules ends up nowhere. That makes npm audit being clean misleading and the NOTICE now lists a version we don't bundle. Sorry, that was my suggestion.
Please drop the override, list dompurify 3.4.8 (Apache-2.0) in the NOTICE, and mention in the description that the remaining findings are in monaco's vendored copy, tracked in microsoft/monaco-editor#5454. We can bump monaco once upstream releases with a newer DOMPurify.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-40590][runtime-web] Update Angular and monaco-editor to latest available versions [flink]
Posted by "MartijnVisser (via GitHub)" <gi...@apache.org>.
MartijnVisser merged PR #29126:
URL: https://github.com/apache/flink/pull/29126
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-40590][runtime-web] Update Angular and monaco-editor to latest patch versions [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #29126:
URL: https://github.com/apache/flink/pull/29126#issuecomment-5574408800
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "08d6cdf1cc990a29c4334571ab22da5d1b248b0e",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "08d6cdf1cc990a29c4334571ab22da5d1b248b0e",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* 08d6cdf1cc990a29c4334571ab22da5d1b248b0e UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-40590][runtime-web] Update Angular and monaco-editor to latest patch versions [flink]
Posted by "MartijnVisser (via GitHub)" <gi...@apache.org>.
MartijnVisser commented on code in PR #29126:
URL: https://github.com/apache/flink/pull/29126#discussion_r3952602804
##########
flink-runtime-web/src/main/resources/META-INF/NOTICE:
##########
@@ -86,14 +86,14 @@ The Apache Software Foundation (http://www.apache.org/).
| date-fns | 2.30.0 | MIT |
| delaunator | 5.1.0 | ISC |
| detect-browser | 5.3.0 | MIT |
-| dompurify | 3.2.7 | Apache-2.0 |
+| dompurify | 3.4.8 | (MPL-2.0 OR Apache-2.0) |
Review Comment:
913207b3afa deliberately picked Apache-2.0 for dompurify because it's dual-licensed. Please keep that: list it as Apache-2.0 and drop the MPL text.
##########
flink-runtime-web/web-dashboard/package.json:
##########
@@ -39,9 +39,9 @@
"@angular-eslint/eslint-plugin-template": "21.4.0",
"@angular-eslint/schematics": "^21.4.0",
"@angular-eslint/template-parser": "21.4.0",
- "@angular/build": "^21.2.17",
+ "@angular/build": "^21.2.22",
"@angular/cli": "^21.2.17",
Review Comment:
Why not bump this one as well? The lock already resolves it to 21.2.23.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org