[PWA-2400] Update packages and dependencies #3611

jeremycharron · 2021-12-10T14:03:44Z

Description

Update packages and dependencies to reduce number of High+ vulnerabilities in yarn and npm audit
yarn audit vulnerabilities were reduced from 82 to 21
npm audit vulnerabilities were reduced from 78 to 17
Vulnerabilities related to Webpack 5, ESLint 8 and Storybook were out of scope as they have dedicated stories.

Related Issue

Closes PWA-2400

Acceptance

Verification Stakeholders

Project maintainers

Specification

Dependencies from root package, create-pwa, pwa-buildpack, venia-concept, venia-integration-tests are impacted

Still generating vulnerabilities - refactor required
@storybook/react: 6.3.7 / 6.4.8 (To be updated in PWA-1867)
webpack : 4.46.0 / 5.65.0 (To be updated to 5 in PWA-1893)
copy-webpack-plugin: Updated to 6.4.0 / 10.0 (7.0 and adove requires Webpack5, tbd in PWA-1893).
boxen: 5.1.2 / 6.2.1 (Version 6 introduces breaking changes - now pure ESM imports)
@pmmmwh/react-refresh-webpack-plugin: 0.4.3 / 0.5.3

Still generating vulnerabilities - module updated to latest version
danger: 10.7.1 / 10.7.1 (published a month ago)
graphql-cli: 4.1.0 / 4.1.0 (published a year ago)
@graphql-cli/validate: 2.1.0 / 2.1.0 (published 2 years ago)
eslint-plugin-package-json: 0.1.4 / 0.1.4 (published 2 years ago)
tap-diff: 0.1.1 / 0.1.1 (published 6 years ago).

No longer generating vulnerabilities
eslint: Updated to 7.32.0 / latest 8.4.1 (Breaking changes - To be updated in PWA-2451)
jest: Updated to 26.6.3 / latest 27.4.3 (Version 27 has multiple breaking changes)
chokidar: Updated to 3.5.2
coveralls: Updated to 3.1.1
graphql-config: Updated to 3.4.1
jest-junit: Updated to 13.0.0
bundlesize: Updated to 0.18.1
inquirer: Updated to 8.2.0
envalid: Updated to 6.0.1
yargs: Updated to 17.3.0
sharp: Updated to 0.29.3

Verification Steps

Test scenario(s) for direct fix/feature

Run yarn audit and npm audit at root, and verify vulnerabilities have been reduced
Perform general regression smoke test on project and updated packages
Verify yarn test works properly
Verify that yarn run lint and yarn run prettier still works
Create scaffold project and verify yarn build and yarn start still works

Is Browser/Device testing needed?

No, device and browser testing is not needed

Any ad-hoc/edge case scenarios that need to be considered?

Not that I can think of, but I still have limited knowledge of the full solution, so any feedback is appreciated

Screenshots / Screen Captures (if appropriate)

Breaking Changes (if any)

Should not have any breaking change

Checklist

I have added tests to cover my changes, if necessary.
I have added translations for new strings, if necessary.
I have updated the documentation accordingly, if necessary.

…endencies

pwa-studio-bot · 2021-12-10T14:13:19Z

	Messages
📖	Associated JIRA tickets: PWA-2400.
📖	DangerCI Failures related to missing labels/description/linked issues/etc will persist until the next push or next nightly build run (assuming they are fixed).
📖	Access a deployed version of this PR here. Make sure to wait for the "pwa-pull-request-deploy" job to complete.

Generated by 🚫 dangerJS against 02d3212

jeremycharron · 2021-12-10T20:52:07Z

packages/pwa-buildpack/lib/__tests__/cli-create-project.spec.js

@@ -44,9 +44,6 @@ test('is a yargs builder', async () => {
    );

    expect(output).toMatch('Create a PWA');
-
-    // throws because it wants a positional argument--just checking
-    expect(() => createProjectCliBuilder.builder(yargs)).toThrow('positional');


Actually not sure about this one. Tests are failing if we keep this. Any feedback is appreciated.

I thought it was an old obsolete test but unfortunately, it runs just fine in develop, so maybe something has changed in this PR:

Develop:

Yes, the test only fails on this branch. If I recall, if was something about .toThrow('positional');

Here's the error generated when running yarn test :

@jeremycharron did you check yargs release notes for this particular exception not throwing?

@pedrochiossi
I'm seeing this as of version 17.0.0 :
.positional() now allowed at root level of yargs

@jeremycharron I don't think this is related, I would look for something on builder function, but if seems it's not on their release notes.

@tjwiebell has written a new test. I will get in touch with him so we can replace this one.

…endencies

revanth0212

Everything seems fine, I have done a smoke test, scaffold test, lint test, prettier test, jest test and a cypress test.

Nice work @jeremycharron

I do have couple of questions though, please check them out.

revanth0212 · 2021-12-15T19:54:54Z

packages/pwa-buildpack/lib/WebpackTools/plugins/UpwardIncludePlugin.js

-            logLevel: 'error'
-        }).apply(this.compiler);
+        new CopyPlugin(
+            { patterns: Object.values(this.assetMap) },


Did they happen to change the syntax for the CopyPlugin?

Yes, we need to have an object now. Ref : https://github.com/webpack-contrib/copy-webpack-plugin/releases/tag/v6.0.0

revanth0212 · 2021-12-15T19:56:11Z

packages/venia-ui/lib/components/ProductOptions/__tests__/options.spec.js

@@ -4,7 +4,7 @@ import { createTestInstance } from '@magento/peregrine';
 import Options from '../options';

 jest.mock('../../../classify');
-jest.mock('uuid/v4', () => () => '00000000-0000-0000-0000-000000000000');
+jest.mock('uuid', () => () => '00000000-0000-0000-0000-000000000000');


I see many such mock updates, is this a code change from the UUID package?

Yes, unfortunately uuid/v4 is deprecated, we must use uuid now. Ref : https://www.npmjs.com/package/uuid#deep-requires-now-deprecated

…endencies

jeremycharron · 2022-01-12T14:21:11Z

Scaffold build is now successful.

…endencies

mikhaelbois · 2022-01-14T18:42:32Z

Here are the audit results on moment of QA.

Project Root - Before

yarn audit
88 vulnerabilities found - Packages audited: 1942
Severity: 60 Moderate | 28 High

npm audit
94 vulnerabilities (3 low, 49 moderate, 40 high, 2 critical)

Scaffold - Before

yarn audit
51 vulnerabilities found - Packages audited: 2543
Severity: 3 Low | 28 Moderate | 18 High | 2 Critical

npm audit
70 vulnerabilities (4 low, 36 moderate, 28 high, 2 critical)

Project Root - After

yarn audit
27 vulnerabilities found - Packages audited: 2015
Severity: 9 Moderate | 18 High

npm audit
75 vulnerabilities (3 low, 36 moderate, 34 high, 2 critical)

Scaffold - After

yarn audit
51 vulnerabilities found - Packages audited: 2543
Severity: 3 Low | 28 Moderate | 18 High | 2 Critical

npm audit
64 vulnerabilities (4 low, 31 moderate, 27 high, 2 critical)

Issue resolved since.

mikhaelbois · 2022-01-14T20:20:21Z

@jeremycharron
Following ran on Project Root ✅

yarn build
yarn lint
yarn prettier:check
yarn stage:venia
yarn storybook:venia
yarn test
yarn watch:venia

yarn watch:all works but the message visual in the console has a cosmetic issue.
Reporting it just in case.

Expected

Current result

Tested scaffolding with Yarn and NPM and everything worked fine for watch and build. ✅

Cypress tests ✅

…github.com:magento/pwa-studio into jcharron/PWA-2400-update-packages-and-dependencies

jeremycharron · 2022-01-17T20:30:24Z

I pushed a fix for yarn watch:all visual being broken.
Boxen version 5 introduces text wrapping which doesn't seem to support long strings very well (such as URLs)
Proposed fix looks like this :

…endencies

supernova-at

Code looks good!

Jeremy Charron added 10 commits December 6, 2021 14:23

PWA-2400 Update dependency - Part 1

103b47c

PWA-2400 Update dependencies - Part 2

0332dd8

PWA-2400 Update dependencies Part 3

7396d68

PWA-2400 Update dependencies - Part 4

f23ab69

PWA-2400 ESlint update

c27907e

PWA-2400 ESlint V7.32, V8.x to be done in another story.

f628039

PWA-2400 Update Yargs

e4674c9

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

9818dba

…endencies

PWA-2400 Put Jest to V26, which has less vulnerabilities and fix tests

ae65b25

PWA-2400 Added missing yarn.lock from venia-integration

bbed449

m2-community-project bot added the Progress: ready for review label Dec 10, 2021

github-actions bot added the needs triage label Dec 10, 2021

jeremycharron changed the title ~~Jcharron/pwa 2400 update packages and dependencies~~ [PWA-2400] Update packages and dependencies Dec 10, 2021

pwa-studio-bot added pkg:create-pwa pkg:pwa-buildpack pkg:venia-concept labels Dec 10, 2021

pwa-studio-bot added the pkg:venia-ui label Dec 10, 2021

jeremycharron added the version: Minor This changeset includes functionality added in a backwards compatible manner. label Dec 10, 2021

jeremycharron commented Dec 10, 2021

View reviewed changes

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

647ee62

…endencies

revanth0212 requested changes Dec 15, 2021

View reviewed changes

m2-community-project bot assigned revanth0212 Dec 15, 2021

m2-community-project bot added Progress: changes requested and removed Progress: ready for review labels Dec 15, 2021

m2-community-project bot added Progress: review and removed Progress: changes requested labels Dec 16, 2021

m2-community-project bot added Progress: approved and removed Progress: review labels Jan 6, 2022

pedrochiossi and others added 3 commits January 6, 2022 11:00

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

64e7abb

…endencies

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

975dc4b

…endencies

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

0d97355

…endencies

dpatil-magento force-pushed the jcharron/PWA-2400-update-packages-and-dependencies branch from cfe7d52 to 0d97355 Compare January 7, 2022 22:17

PWA-2400 Adjust graphql-config version to fix scaffold build error

90b2028

jeremycharron dismissed pedrochiossi’s stale review via 90b2028 January 12, 2022 13:56

m2-community-project bot added Progress: review and removed Progress: approved labels Jan 12, 2022

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

34895f7

…endencies

Jeremy Charron added 2 commits January 17, 2022 15:09

PWA-2400 Fix yarn watch:all visual issue

19255bc

Merge branch 'jcharron/PWA-2400-update-packages-and-dependencies' of …

8c4b43f

…github.com:magento/pwa-studio into jcharron/PWA-2400-update-packages-and-dependencies

Merge branch 'develop' into jcharron/PWA-2400-update-packages-and-dep…

02d3212

…endencies

supernova-at approved these changes Jan 18, 2022

View reviewed changes

m2-community-project bot assigned supernova-at Jan 18, 2022

m2-community-project bot added Progress: approved and removed Progress: review labels Jan 18, 2022

mikhaelbois merged commit 4e71fb8 into develop Jan 18, 2022

m2-community-project bot added Progress: done and removed Progress: approved labels Jan 18, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[PWA-2400] Update packages and dependencies #3611

[PWA-2400] Update packages and dependencies #3611

jeremycharron commented Dec 10, 2021 •

edited

Loading

pwa-studio-bot commented Dec 10, 2021 •

edited

Loading

jeremycharron Dec 10, 2021

revanth0212 Dec 17, 2021

jeremycharron Dec 17, 2021

jeremycharron Dec 20, 2021

pedrochiossi Dec 21, 2021

jeremycharron Dec 21, 2021

pedrochiossi Dec 22, 2021

jeremycharron Dec 22, 2021

revanth0212 left a comment

revanth0212 Dec 15, 2021

jeremycharron Dec 16, 2021

revanth0212 Dec 15, 2021

jeremycharron Dec 16, 2021 •

edited

Loading

jeremycharron commented Jan 12, 2022

mikhaelbois commented Jan 14, 2022

mikhaelbois commented Jan 14, 2022

jeremycharron commented Jan 17, 2022

supernova-at left a comment •

edited

Loading

[PWA-2400] Update packages and dependencies #3611

[PWA-2400] Update packages and dependencies #3611

Conversation

jeremycharron commented Dec 10, 2021 • edited Loading

Description

Related Issue

Acceptance

Verification Stakeholders

Specification

Verification Steps

Test scenario(s) for direct fix/feature

Is Browser/Device testing needed?

Any ad-hoc/edge case scenarios that need to be considered?

Screenshots / Screen Captures (if appropriate)

Breaking Changes (if any)

Checklist

pwa-studio-bot commented Dec 10, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

revanth0212 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jeremycharron Dec 16, 2021 • edited Loading

Choose a reason for hiding this comment

jeremycharron commented Jan 12, 2022

mikhaelbois commented Jan 14, 2022

mikhaelbois commented Jan 14, 2022

jeremycharron commented Jan 17, 2022

supernova-at left a comment • edited Loading

Choose a reason for hiding this comment

jeremycharron commented Dec 10, 2021 •

edited

Loading

pwa-studio-bot commented Dec 10, 2021 •

edited

Loading

jeremycharron Dec 16, 2021 •

edited

Loading

supernova-at left a comment •

edited

Loading