Updates to resolve vulnerability warnings #24

johnworth · 2019-12-12T15:26:50Z

When ui-lib was pulled into neat-example, npm started reporting over 2k vulnerabilities. This pull request is an attempt to get that number as close to 0 as possible.

This required an update to react-scripts. Its dependencies are a source of ~70 vulnerabilities, plus I can't get unit tests to run on newer versions of macOS without an upgrade.

I'm running the newest version of macOS, which has issues with older versions of fsevents, which is pulled in because of react-scripts. As a result, I cannot run unit tests against this update. I'll tackle react-scripts next, since it's dependencies are the source of 69 vulnerabilities.

The unit tests are passing and storybook is working, but there are a couple of lingering error messages that need to be looked into.

Storybook was spewing warnings about using default exports in the same file as storiesOf(), so I modified the stories to remove the default keyword. The exports are still available, but they're no longer the default. The unit tests were modified to use the new non-default exports from the stories. In a couple of cases, inconsistencies in the names of the imported/exported items were fixed.

oneOf() checks values, oneOfType() checks types which is what was actually desired.

johnworth · 2019-12-12T16:33:53Z

I'm seeing the following deprecation warning, but it seems to require an update of something provided my material-ui so I left it alone for now:

Warning: componentWillReceiveProps has been renamed, and is not recommended for use. See https://fb.me/react-unsafe-component-lifecycles for details. * Move data fetching code or side effects to componentDidUpdate. * If you're updating state whenever props change, refactor your code to use memoization techniques or move it to static getDerivedStateFromProps. Learn more at: https://fb.me/react-derived-state * Rename componentWillReceiveProps to UNSAFE_componentWillReceiveProps to suppress this warning in non-strict mode. In React 17.x, only the UNSAFE_ name will work. To rename all deprecated lifecycles to their new names, you can run npx react-codemod rename-unsafe-lifecycles in your project source folder. Please update the following components: AutosizeInput, Creatable, Select

ash3rz · 2019-12-12T17:42:50Z

stories/CopyTextArea.stories.js

@@ -6,7 +6,7 @@ import React, { Component } from "react";
 import CopyTextArea from "../src/components/copy/CopyTextArea";
 import { storiesOf } from "@storybook/react";

-export default class CopyTextAreaTest extends Component {
+export class CopyTextAreaTest extends Component {


Can you provide the error/warning you're getting that prompted this change? I'm not seeing anything on my machine when I run Storybook.

I'm seeing this in the Actions pane in Storybook:

That's what I'm seeing on the master branch, I should add.

ash3rz · 2019-12-12T17:46:09Z

package.json

@@ -22,7 +23,8 @@
        "react": "^16.8.6",
        "react-dom": "^16.8.6",
        "react-intl": "^2.9.0",
-        "react-select": "^2.0.0"
+        "react-select": "^2.0.0",


This is where you're getting the componentWillReceiveProps warning. Looks like they recently pushed out v3.0.7 which has the fix for this. Since they bumped a major version though, we may have to update our Autocomplete component for any breaking changes.

JedWatson/react-select#3720

Thanks, good to know. I had a suspicion that's where it was coming from based on the error message, but since it was just a warning I didn't want to risk breaking a ton of stuff.

Or move onto https://material-ui.com/components/autocomplete/

ash3rz · 2019-12-12T18:00:55Z

package.json

@@ -22,7 +23,8 @@
        "react": "^16.8.6",
        "react-dom": "^16.8.6",
        "react-intl": "^2.9.0",
-        "react-select": "^2.0.0"
+        "react-select": "^2.0.0",
+        "typescript": "^3.7.3"


This peer dependency will currently not work with the DE. We could go with a branching strategy like you suggested, but then I'm not sure how that will work since we push and build ui-lib as a version to npm 🤔 I'm not sure if we want to just version lock the DE to whatever version it's at now and let Sonora get all the updates?

Yeah, I think we can limit the DE to the current major version (allowing for bug fixes as minor version updates), but let the Sonora get the latest updates. Honestly, I think that's going to be required.

For clarification, I mean something like limit the DE to ^1.0.0 (just as an example) which is built and pushed to npm from the DE branch, while master continues to have the lastest code starting with version 2.0.0. I pulled those version numbers out of the air just as examples.

ash3rz · 2019-12-12T18:01:32Z

src/components/copy/CopyTextArea.js

@@ -79,7 +79,7 @@ CopyTextArea.propTypes = {
    debugIdPrefix: PropTypes.string,
    multiline: PropTypes.bool,
    text: PropTypes.string.isRequired,
-    btnText: PropTypes.oneOf([PropTypes.string, PropTypes.object]),
+    btnText: PropTypes.oneOfType([PropTypes.string, PropTypes.object]),


oops, that was my tpyo, thanks for fixing!

sri2k1us

Looks good to me. Should we bump this change to version 1.x ?

johnworth · 2020-01-07T16:05:36Z

I'll bump up the version here and create a branch/tag to maintain a build for the old DE.

slr71

I'm not an expert in any of this, but it looks good to me.

johnworth · 2020-01-07T17:42:28Z

After discussing things with Sarah and Sriram a bit, I'm going to go ahead and merge this.

ash3rz

LGTM

johnworth · 2020-01-07T17:43:24Z

Thanks for the reviews!

John Wregglesworth added 2 commits December 12, 2019 08:02

Update react-scripts to 3.3.0.

8d1a1f4

The unit tests are passing and storybook is working, but there are a couple of lingering error messages that need to be looked into.

johnworth requested review from psarando, sri2k1us and ash3rz December 12, 2019 15:26

John Wregglesworth added 4 commits December 12, 2019 08:48

Removed unused import from Autocomplete.stories.js

b6b760e

Use PropTypes.oneOfType() instead of oneOf().

a538974

oneOf() checks values, oneOfType() checks types which is what was actually desired.

Add typescript as a peerDependency

eba0c6a

johnworth changed the title ~~WIP: Updates to resolve vulnerability warnings~~ Updates to resolve vulnerability warnings Dec 12, 2019

ash3rz reviewed Dec 12, 2019

View reviewed changes

sri2k1us approved these changes Jan 7, 2020

View reviewed changes

Bump version to 1.0.0

1769c4a

slr71 approved these changes Jan 7, 2020

View reviewed changes

johnworth requested a review from ash3rz January 7, 2020 16:30

johnworth merged commit 8c953b8 into cyverse-archive:master Jan 7, 2020

ash3rz approved these changes Jan 7, 2020

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Updates to resolve vulnerability warnings #24

Updates to resolve vulnerability warnings #24

johnworth commented Dec 12, 2019 •

edited

Loading

johnworth commented Dec 12, 2019

ash3rz Dec 12, 2019

johnworth Dec 12, 2019

johnworth Dec 12, 2019

ash3rz Dec 12, 2019

johnworth Dec 12, 2019

sri2k1us Jan 7, 2020

ash3rz Dec 12, 2019

johnworth Dec 12, 2019

johnworth Dec 12, 2019

ash3rz Dec 12, 2019

sri2k1us left a comment

johnworth commented Jan 7, 2020

slr71 left a comment

johnworth commented Jan 7, 2020

ash3rz left a comment

johnworth commented Jan 7, 2020

Updates to resolve vulnerability warnings #24

Updates to resolve vulnerability warnings #24

Conversation

johnworth commented Dec 12, 2019 • edited Loading

johnworth commented Dec 12, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sri2k1us left a comment

Choose a reason for hiding this comment

johnworth commented Jan 7, 2020

slr71 left a comment

Choose a reason for hiding this comment

johnworth commented Jan 7, 2020

ash3rz left a comment

Choose a reason for hiding this comment

johnworth commented Jan 7, 2020

johnworth commented Dec 12, 2019 •

edited

Loading