ui package upgrades - #13632
Open
DaanHoogland wants to merge 28 commits into
Open
Conversation
DaanHoogland
force-pushed
the
ghi13631-ui-package-upgrades
branch
from
July 16, 2026 14:13
f22a38a to
2356504
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13632 +/- ##
==========================================
Coverage 19.65% 19.65%
+ Complexity 19792 19790 -2
==========================================
Files 6368 6368
Lines 575107 574529 -578
Branches 70370 70353 -17
==========================================
- Hits 113016 112916 -100
+ Misses 449808 449341 -467
+ Partials 12283 12272 -11
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Fixes 17 CVEs in dompurify 3.2.6 including multiple XSS bypass vulnerabilities (GHSA-cjmm-f4jc-qw8r, GHSA-cmwh-pvxp-8882, et al.). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-wc69-rhjr-hc9g in moment 2.29.3. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-qjx8-664m-686j. Note: major version bump — js-cookie 3.x drops the global Cookies object; call sites using Cookies.get() etc. may need updating. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes 21 CVEs in the abandoned axios 0.x branch including GHSA-898c-q2cr-xwhg (SSRF/header exposure). Note: major version bump — axios 1.x removes deprecated helpers and changes some error properties; review src/utils/request.js call sites. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build: ✔️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upgrades fontawesome-svg-core, free-brands-svg-icons, free-solid-svg-icons to 6.7.2 and vue-fontawesome to 3.3.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
webpack 4 uses the MD4 hash algorithm which OpenSSL 3 (Node 17+) no longer provides by default, causing ERR_OSSL_EVP_UNSUPPORTED. NODE_OPTIONS is used (rather than a direct node flag) so the setting is inherited by all child processes that webpack spawns during the build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build failed: ✖️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Three independent issues surfaced after the recent package upgrades and were causing the UI Build workflow to fail: - The Node 17+/OpenSSL 3 fix (NODE_OPTIONS='--openssl-legacy-provider') crashes on Node 16, which is what CI actually uses, since that flag doesn't exist without OpenSSL 3. Move it into a wrapper script that only sets it when the running Node actually needs it. - @vue/compiler-sfc 3.5.40 (up from 3.2.37) now only enables the jsx babel parser plugin for <script lang="jsx">/<script setup lang="tsx"> blocks; it silently discards a 'jsx' entry from user-supplied babelParserPlugins otherwise. Views using inline JSX in a plain <script> block (already relying on cli-service's babelParserPlugins config) now fail to compile, surfacing as an unrelated-looking "Cannot read properties of null (reading 'content')" since vue-loader swallows the real compileScript error. Tag those <script> blocks lang="jsx" explicitly. - vue-router 4.6.4 and minio 7.1.3 (with its fast-xml-parser dependency) ship modern syntax (class fields, optional chaining) in both their ESM and CJS builds, which webpack 4's parser can't handle. Add them to transpileDependencies so babel processes them like first-party source. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build: ✔️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
npm run serve/start/build now set --openssl-legacy-provider automatically via node-options-wrapper.sh, only when the running Node actually needs it. The old manual instruction is not just redundant but actively harmful: a contributor who exports it persistently and later runs on Node 16 (what CI pins) crashes node outright, since that flag doesn't exist without OpenSSL 3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Comment on lines
+23
to
+26
| NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]") | ||
| if [ "$NODE_MAJOR" -ge 17 ]; then | ||
| export NODE_OPTIONS="--openssl-legacy-provider ${NODE_OPTIONS}" | ||
| fi |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.
Suppressed comments (1)
ui/node-options-wrapper.sh:26
- The wrapper always injects
--openssl-legacy-providerfor Node >=17, but newer Node releases can reject this option inNODE_OPTIONS. If that happens,npm run serve/buildwill fail immediately even if the legacy provider workaround is no longer supported. Consider probing support before exporting the flag (and avoid integer-test errors ifnodeisn't available).
NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]")
if [ "$NODE_MAJOR" -ge 17 ]; then
export NODE_OPTIONS="--openssl-legacy-provider${NODE_OPTIONS:+ ${NODE_OPTIONS}}"
fi
| # Build example: docker build -t <name> . | ||
|
|
||
| FROM node:14-bullseye AS build | ||
| FROM node:24-bullseye AS build |
Contributor
Author
There was a problem hiding this comment.
@vishesh92 , I think this means we have the choice to
- add the webpack upgrade in this PR, or
- change the node version to 20 and upgrade it in a new PR
(maybe seeing more bears on the road than actually are there)
|
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.67% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR...
Fixes: #13631
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?