Re: [PR] chore(deps-dev): bump the swc group in /superset-frontend with 3 updates [superset]

["sadpandajoe (via GitHub)" <gi...@apache.org>]

sadpandajoe commented on code in PR #43447:
URL: https://github.com/apache/superset/pull/43447#discussion_r3855659531


##########
.github/dependabot.yml:
##########
@@ -80,6 +80,11 @@ updates:
         patterns:
           - "ag-grid-react"
           - "ag-grid-community"
+      swc:
+        patterns:
+          - "@swc/core"
+          - "@swc/plugin-emotion"
+          - "@swc/plugin-transform-imports"

Review Comment:
   Because this package is still unconditionally ignored above, Dependabot will exclude it from future `swc` group updates. That can leave the transform plugin behind while the other SWC components advance, despite the group being intended to keep this compatibility boundary together. Should the ignore be removed or narrowed now that the package is being grouped?



##########
superset-frontend/package-lock.json:
##########
@@ -43073,15 +43091,6 @@
         "node": ">=12"
       }
     },
-    "packages/superset-ui-core/node_modules/dompurify": {
-      "version": "3.4.13",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.13.tgz",
-      "integrity": "sha512-2vmYIoqjze2d+kakP8S/nS5shfsl587kzwEjcGlTdiksUVgFHnFCsLYDVj/JNqJVOQZGSYBTmuycv0PodwmnMQ==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
-      }
-    },
     "packages/superset-ui-core/node_modules/react-ace": {

Review Comment:
   Removing the adjacent `@superset-ui/core` DOMPurify resolution leaves that workspace's `^3.4.13` dependency satisfied only by the hoisted 3.4.12 entry. A clean install can therefore reject or rewrite this lock graph. Could the 3.4.13 resolution be restored (or the DOMPurify update be made explicit)?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org