You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@kyuubi.apache.org by "wangzhigang1999 (via GitHub)" <gi...@apache.org> on 2026/07/01 08:30:49 UTC
[PR] [WIP][KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories [kyuubi]
wangzhigang1999 opened a new pull request, #7534:
URL: https://github.com/apache/kyuubi/pull/7534
### Why are the changes needed?
The web-ui toolchain is years behind and partly EOL (vite 4.5, vitest 0.32, vue-tsc 0.38, TS 4.6), with open dependency advisories. This consolidates Dependabot's 11 web-ui PRs and modernizes the toolchain in one change.
- Toolchain: vite 4→8, vitest/coverage-v8 0.32→4, plugin-vue 4→6, vue-tsc 0.38→3.3, TS 4.6→5.9, jsdom 20→26, sass→1.101, @types/node→22.
- Security: vue-i18n 9.2→9.14.5, element-plus 2.2→2.14, lodash/lodash-es→4.18.1 (pnpm overrides). `pnpm audit --prod`: 3 high / 7 moderate → 0.
- CI `node.version` v20.17→v22.23.1 (required by vite 8; derived from the Maven property, no workflow edits).
- Removed the unused `package-lock.json` (the module builds with pnpm).
ESLint 8→9 (flat-config) is deferred to a follow-up.
### How was this patch tested?
`pnpm install --frozen-lockfile`, `build`, `coverage` (80 tests), and `lint` pass on Node 22 / pnpm 9.11; `pnpm audit --prod` = 0. Manually verified all routes and interactive features (i18n switch, Monaco, run SQL → result grid, tabs, data-agent, sign-in) against a running Kyuubi instance — no console errors.
### Was this patch authored or co-authored using generative AI tooling?
Assisted-by: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 closed pull request #7534: [KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories
URL: https://github.com/apache/kyuubi/pull/7534
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on PR #7534:
URL: https://github.com/apache/kyuubi/pull/7534#issuecomment-4861505308
Thank you all for the review; merged into master.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org
Re: [PR] [WIP][KYUUBI #7533][WEBUI] Upgrade web-ui build toolchain and fix dependency security advisories [kyuubi]
Posted by "wangzhigang1999 (via GitHub)" <gi...@apache.org>.
wangzhigang1999 commented on PR #7534:
URL: https://github.com/apache/kyuubi/pull/7534#issuecomment-4852733482
Once this PR is merged, the following Dependabot web-ui security bumps become redundant and can be closed — each affected package is either removed from the tree or already at/above the patched version
here:
- #7514 form-data — no longer in the dependency tree
- #7470 @tootallnate/once — no longer in the dependency tree
- #7353 @tootallnate/once + jsdom — @tootallnate/once removed; jsdom bumped to 26
- #7423 postcss — now 8.5.16 (≥ 8.5.12)
- #7376 lodash — now 4.18.1 (via pnpm overrides)
- #7375 lodash-es — now 4.18.1 (via pnpm overrides)
- #7336 rollup — no longer in the tree (vite 8 uses rolldown)
Still open and intentionally not covered here — dev-only transitive deps of ESLint 8, to be resolved by the follow-up ESLint 9 (flat-config) upgrade: #7532 (js-yaml), #7340 (ajv), #7364 (flatted), #7338
(minimatch).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@kyuubi.apache.org
For additional commands, e-mail: notifications-help@kyuubi.apache.org