dependency maintenance #354

nickgros · 2023-07-06T19:54:54Z

Ran pnpm update --recursive and followed up with a few manual version changes to achieve the following

Fix all issues that appear in pnpm audit that have an upgrade path
Fix all but one peer dependency issues
Remove project-specific resolutions fields (these had no effect on dependency resolution)
Small changes to account for package updates

Additionally, update our SBOM upload workflow to continue getting vulnerability alerts (still needed while we wait on dependabot/dependabot-core#7434).

nickgros · 2023-07-06T19:55:13Z

.github/workflows/sbom.yml

@@ -28,6 +27,6 @@ jobs:
          name: sbom
          path: _manifest/spdx_2.2
      - name: SBOM upload
-        uses: jhutchings1/[email protected]


original repo was archived and points to this new action

nickgros · 2023-07-06T19:56:26Z

apps/SageAccountWeb/package.json

-  "resolutions": {
-    "js-yaml": "3.13.1",
-    "react": "18.2.0",
-    "react-hot-toast": "2.2.0",
-    "@types/react": "18.0.17",
-    "@types/react-dom": "18.0.6",
-    "minimatch": "^3.1.2"
-  },


According to the output of pnpm install, these resolution entries are ignored. Only the base package.json resolutions are used.

See docs for overrides: https://pnpm.io/package_json#pnpmoverrides - this is the same feature, just a different property name.

- Bump dependencies shown in `pnpm audit` that have valid patches - Update SBOM workflow for security updates - Remove project-specific `resolutions` fields (these had no effect on dependency resolution)

- bump TypeScript to 5.1.6

nickgros · 2023-07-10T14:15:30Z

packages/synapse-react-client/src/components/StandaloneQueryWrapper/StandaloneQueryWrapper.tsx

@@ -46,6 +46,7 @@ type StandaloneQueryWrapperOwnProps = {
    | 'columnAliases'
    | 'noContentPlaceholderType'
    | 'showLastUpdatedOn'
+    | 'visibleColumnCount'


This was missing in the prop signature, but the prop was still passed down, so this is a type-only change.

nickgros · 2023-07-10T14:18:04Z

packages/synapse-react-client/src/synapse-queries/dataaccess/useAccessRequirements.ts

@@ -158,6 +158,7 @@ export function useCreateLockAccessRequirement(
      if (options?.onSuccess) {
        return options.onSuccess(data, variables, ctx)
      }
+      return


These functions must have a return statement. If I had to guess, it probably has something to do with this TypeScript change and some (outdated) react-query types.

nickgros · 2023-07-10T14:18:29Z

packages/synapse-react-client/src/theme/useTheme.tsx

@@ -6,7 +6,7 @@ import defaultMuiThemeOptions from './DefaultTheme'
 import type { PartialDeep } from 'type-fest'

 export function mergeTheme(
-  themeOverrides: PartialDeep<ThemeOptions>,
+  themeOverrides: ThemeOptions | PartialDeep<ThemeOptions>,


MUI/Emotion update required this change. Some change in their types makes ThemeOptions not satisfy PartialDeep<ThemeOptions>. May be a bug in type-fest, which provides the PartialDeep utility type.

nickgros · 2023-07-10T14:45:21Z

packages/vite-config/src/vite-config.ts


-export default defineConfig({
+export const config: UserConfig = {


Some changes in types required separating the config object from the config definition.

nickgros · 2023-07-10T16:11:55Z

apps/SageAccountWeb/package.json

-    "react-easy-crop": "^4.2.0",
-    "react-query": "3.39.1",
-    "react-router-dom": "5.3.3",
-    "react-spinners": "^0.11.0",


Dropped react-spinners as it is unused in this project.

nickgros · 2023-07-10T16:16:53Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useEntityBundle.test.tsx

@@ -1,4 +1,4 @@
-import { renderHook } from '@testing-library/react-hooks'
+import { renderHook } from '@testing-library/react'


Functionality in @testing-library/react-hooks has been ported to @testing-library/react, so we dropped @testing-library/react-hooks

nickgros · 2023-07-10T16:17:27Z

packages/synapse-react-client/test/utils/hooks/usePreFetchResource.integration.test.tsx

@@ -36,14 +36,13 @@ describe('usePreFetchResource tests', () => {
      ),
    )

-    const { result, waitForNextUpdate } = renderHook(() =>


waitForNextUpdate is not in @testing-library/react, but that's ok, we can just use waitFor

nickgros · 2023-07-10T16:43:24Z

packages/synapse-react-client/src/assets/illustrations/challenges_illustration.svg

Dropped an <?xml > tag that was not parseable by upgraded esbuild

nickgros · 2023-07-11T14:56:09Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useEntityBundle.test.tsx

-const SynapseClient = require('../../../../src/synapse-client/SynapseClient')
-SynapseClient.getEntityBundleV2 = jest.fn().mockResolvedValue(expected)


Replaced dynamic require import with jest.spyOn

nickgros · 2023-07-11T14:56:23Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useEntityBundle.test.tsx

-
-const queryClient = new QueryClient()
-
-const wrapper = (props: { children: React.ReactChildren }) => (


Replace with existing utility

nickgros · 2023-07-11T14:57:33Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useEntityBundle.test.tsx

    })

-    await waitFor(() => result.current.isSuccess)


The returned waitFor must have allowed returning a boolean. The imported waitFor check doesn't work unless an error is thrown, such as if an expect fails.

nickgros · 2023-07-11T14:58:31Z

packages/vite-config/src/vite-config.ts

No meaningful config changes, just updated to work with new types

nickgros · 2023-07-11T14:58:57Z

packages/vite-config/src/vitest-config.ts

Config itself unchanged, just reformatted and structure changed to work with type changes

nickgros · 2023-07-11T15:05:22Z

.github/workflows/sbom.yml

This workflow pushes a dependency list from our lockfile to a Microsoft tool that generates and reports security vulnerabilities. It's our workaround to get vulnerability alerts until GitHub supports Dependabot security updates for pnpm.

nickgros · 2023-07-11T15:06:09Z

apps/SageAccountWeb/package.json

-    "vite": "^4.3.4",
+    "tslib": "^2.6.0",
+    "type-fest": "^3.13.0",
+    "typescript": "5.1.6",


Upgraded TS everywhere

nickgros · 2023-07-11T15:07:33Z

apps/SageAccountWeb/package.json

@@ -56,27 +55,27 @@
    "markdown-it-strikethrough-alt": "^1.0.0",
    "markdown-it-sub-alt": "^1.0.0",
    "markdown-it-sup-alt": "^1.0.2",
-    "markdown-it-synapse": "^1.1.7",
+    "markdown-it-synapse": "workspace:^",


Using workspace markdown-it-synapse for devDependencies, but I think all of the apps are pulling an old version from CDN. Since the bundling strategy changed, that should be tackled separately

nickgros · 2023-07-11T15:08:06Z

apps/synapse-oauth-signin/package.json

    "react-cookie": "4.0.0",
    "react-dom": "^18.2.0",
-    "react-query": "3.39.1",
-    "react-router-dom": "5.3.3",
-    "react-spinners": "^0.11.0",


react-spinners also unused here

nickgros · 2023-07-11T15:08:29Z

apps/synapse-oauth-signin/package.json

-    "memfs": "^3.4.7",
-    "msw": "^0.49.3",
+    "memfs": "^3.5.3",
+    "msw": "^1.2.2",


Bump to match other packages

nickgros · 2023-07-11T15:10:51Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useGetEntityChildren.test.tsx

Renamed to .ts

nickgros · 2023-07-11T15:11:00Z

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useGetEntityChildren.test.ts

renamed from .tsx, bad diff

nickgros commented Jul 6, 2023

View reviewed changes

dependency maintenance

4e1f71d

- Bump dependencies shown in `pnpm audit` that have valid patches - Update SBOM workflow for security updates - Remove project-specific `resolutions` fields (these had no effect on dependency resolution)

nickgros force-pushed the bump-deps branch from 293dacd to 4e1f71d Compare July 7, 2023 11:54

nickgros added 2 commits July 7, 2023 14:53

- bump all dependencies with pnpm up -r

5aac711

- bump TypeScript to 5.1.6

Fix type errors

38e881f

nickgros commented Jul 10, 2023

View reviewed changes

nickgros added 2 commits July 10, 2023 10:23

Run pnpm update --recursive once more

0b84ffb

vite config fixes + bump vitest version

72168b0

nickgros commented Jul 10, 2023

View reviewed changes

nickgros added 2 commits July 10, 2023 11:42

resolved all but one peer dependency issues

a608c33

undo removing react-switch

d126033

nickgros commented Jul 10, 2023

View reviewed changes

fix svg that failed to parse

727de7e

nickgros commented Jul 10, 2023

View reviewed changes

nickgros added 2 commits July 10, 2023 13:53

fix test issues

a0004f6

fix + simplify more tests

0bb8ed3

nickgros added the chromatic Deploys the latest commit on this PR to Chromatic and runs snapshot tests label Jul 11, 2023

nickgros commented Jul 11, 2023

View reviewed changes

packages/vite-config/src/vite-config.ts

Copy link

Collaborator Author

nickgros Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No meaningful config changes, just updated to work with new types

nickgros commented Jul 11, 2023

View reviewed changes

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useGetEntityChildren.test.tsx

Copy link

Collaborator Author

nickgros Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renamed to .ts

nickgros commented Jul 11, 2023

View reviewed changes

packages/synapse-react-client/test/utils/hooks/SynapseAPI/useGetEntityChildren.test.ts

Copy link

Collaborator Author

nickgros Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

renamed from .tsx, bad diff

jay-hodgson approved these changes Jul 11, 2023

View reviewed changes

nickgros merged commit 1000526 into Sage-Bionetworks:main Jul 11, 2023

This was referenced Jul 11, 2023

Revert "dependency maintenance" #359

Merged

Bump dependencies, take 2 #361

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dependency maintenance #354

dependency maintenance #354

nickgros commented Jul 6, 2023 •

edited

Loading

nickgros Jul 6, 2023

nickgros Jul 6, 2023

nickgros Jul 6, 2023

nickgros Jul 10, 2023

nickgros Jul 10, 2023

nickgros Jul 10, 2023 •

edited

Loading

nickgros Jul 10, 2023

nickgros Jul 10, 2023

nickgros Jul 10, 2023

nickgros Jul 10, 2023

nickgros Jul 10, 2023 •

edited

Loading

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023 •

edited

Loading

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023

nickgros Jul 11, 2023


		export default defineConfig({
		export const config: UserConfig = {

		@@ -1,4 +1,4 @@
		import { renderHook } from '@testing-library/react-hooks'
		import { renderHook } from '@testing-library/react'

		const SynapseClient = require('../../../../src/synapse-client/SynapseClient')
		SynapseClient.getEntityBundleV2 = jest.fn().mockResolvedValue(expected)


		const queryClient = new QueryClient()

		const wrapper = (props: { children: React.ReactChildren }) => (

dependency maintenance #354

dependency maintenance #354

Conversation

nickgros commented Jul 6, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickgros Jul 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickgros Jul 10, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickgros Jul 11, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nickgros commented Jul 6, 2023 •

edited

Loading

nickgros Jul 10, 2023 •

edited

Loading

nickgros Jul 10, 2023 •

edited

Loading

nickgros Jul 11, 2023 •

edited

Loading