ui package upgrades#13632
Open
DaanHoogland wants to merge 27 commits into
Open
Conversation
DaanHoogland
force-pushed
the
ghi13631-ui-package-upgrades
branch
from
July 16, 2026 14:13
f22a38a to
2356504
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #13632 +/- ##
============================================
- Coverage 19.65% 19.64% -0.01%
+ Complexity 19792 19790 -2
============================================
Files 6368 6368
Lines 575107 575520 +413
Branches 70370 70371 +1
============================================
+ Hits 113016 113054 +38
- Misses 449808 450178 +370
- Partials 12283 12288 +5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Fixes 17 CVEs in dompurify 3.2.6 including multiple XSS bypass vulnerabilities (GHSA-cjmm-f4jc-qw8r, GHSA-cmwh-pvxp-8882, et al.). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-wc69-rhjr-hc9g in moment 2.29.3. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes GHSA-qjx8-664m-686j. Note: major version bump — js-cookie 3.x drops the global Cookies object; call sites using Cookies.get() etc. may need updating. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes 21 CVEs in the abandoned axios 0.x branch including GHSA-898c-q2cr-xwhg (SSRF/header exposure). Note: major version bump — axios 1.x removes deprecated helpers and changes some error properties; review src/utils/request.js call sites. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build: ✔️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Upgrades fontawesome-svg-core, free-brands-svg-icons, free-solid-svg-icons to 6.7.2 and vue-fontawesome to 3.3.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
webpack 4 uses the MD4 hash algorithm which OpenSSL 3 (Node 17+) no longer provides by default, causing ERR_OSSL_EVP_UNSUPPORTED. NODE_OPTIONS is used (rather than a direct node flag) so the setting is inherited by all child processes that webpack spawns during the build. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build failed: ✖️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Three independent issues surfaced after the recent package upgrades and were causing the UI Build workflow to fail: - The Node 17+/OpenSSL 3 fix (NODE_OPTIONS='--openssl-legacy-provider') crashes on Node 16, which is what CI actually uses, since that flag doesn't exist without OpenSSL 3. Move it into a wrapper script that only sets it when the running Node actually needs it. - @vue/compiler-sfc 3.5.40 (up from 3.2.37) now only enables the jsx babel parser plugin for <script lang="jsx">/<script setup lang="tsx"> blocks; it silently discards a 'jsx' entry from user-supplied babelParserPlugins otherwise. Views using inline JSX in a plain <script> block (already relying on cli-service's babelParserPlugins config) now fail to compile, surfacing as an unrelated-looking "Cannot read properties of null (reading 'content')" since vue-loader swallows the real compileScript error. Tag those <script> blocks lang="jsx" explicitly. - vue-router 4.6.4 and minio 7.1.3 (with its fast-xml-parser dependency) ship modern syntax (class fields, optional chaining) in both their ESM and CJS builds, which webpack 4's parser can't handle. Add them to transpileDependencies so babel processes them like first-party source. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
Author
|
@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress. |
|
UI build: ✔️ |
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
npm run serve/start/build now set --openssl-legacy-provider automatically via node-options-wrapper.sh, only when the running Node actually needs it. The old manual instruction is not just redundant but actively harmful: a contributor who exports it persistently and later runs on Node 16 (what CI pins) crashes node outright, since that flag doesn't exist without OpenSSL 3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Comment on lines
+23
to
+26
| NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]") | ||
| if [ "$NODE_MAJOR" -ge 17 ]; then | ||
| export NODE_OPTIONS="--openssl-legacy-provider ${NODE_OPTIONS}" | ||
| fi |
| "build": "vue-cli-service build", | ||
| "start": "./node-options-wrapper.sh vue-cli-service lint --no-fix && ./node-options-wrapper.sh vue-cli-service serve", | ||
| "serve": "./node-options-wrapper.sh vue-cli-service lint --no-fix && ./node-options-wrapper.sh vue-cli-service serve", | ||
| "build": "NODE_OPTIONS='--max-old-space-size=4096' ./node-options-wrapper.sh vue-cli-service build", |
|
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 24.50% |
| Branch coverage | 18.66% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR...
Fixes: #13631
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?