chore: Clean up deps and npm audit issues #2058

jdeichert · 2024-10-03T18:00:03Z

Motivations

This PR cleans up a number of High Severity audit issues (from 19, down to 1). To achieve this, I tried to make the minimum amount of changes required. Along the way, I attempted to clean up some old, unnecessary dependencies as well. Check out my inline comments for more context.

This also closes a number of open Dependabot PRs:

Before	After

Changes

Changed

Updated plop from v2 to v4
Updated all storybook deps to match 7.6.20
Updated react-native to match JM's version
- Fixed some type-related issues due to this

Removed

Unused dependencies

Security

Reduced 19 high sev issues down to 1

Testing

To test this:

install the pre-release versions (comment) inside JO/JF/JM
poke around and make sure everything seems to look normal
- I ran through creating client->request->quote->job->invoice as a basic flow to ensure things are working nicely
I also ran through every storybook story to make sure they loaded fine. I didn't notice any problems there.
Test out plop v4 via npm run generate to ensure it still works

Changes can be tested via Pre-release

These haven't been used directly by the design package for awhile.. probably since the big design token rewrite. Also removed from the root package.json as it isn't a direct dependency.. storybook uses it as a sub dep.

cloudflare-workers-and-pages · 2024-10-03T18:03:33Z

Deploying atlantis with Cloudflare Pages

Latest commit:	`6d2c97c`
Status:	✅ Deploy successful!
Preview URL:	https://330880bc.atlantis.pages.dev
Branch Preview URL:	https://cleanup-bumps-deps-attempt2.atlantis.pages.dev

View logs

jdeichert · 2024-10-03T19:09:23Z

packages/design/src/index.ts

-    width: string | number;
-    height: string | number;
+    width: number;
+    height: number;


After upgrading react-native, it was complaining about these prop types on our Icon component. Removing string fixed it.

Notably our components-native package uses the version of react-native inside JM (it's a peer dep) which is already on 0.73.9. This means this should have zero impact as we haven't had any reported issues with icons yet.

jdeichert · 2024-10-03T19:11:47Z

packages/docx/package.json

-  "main": "src/index.ts",
-  "scripts": {},
-  "devDependencies": {
-    "react": "^16.8.6"


Wasn't necessary thankfully 😅

jdeichert · 2024-10-03T19:12:35Z

package.json

    "react-intl": "^6.4.2",
-    "react-native": "^0.71.7",
+    "react-native": "0.73.9",


Upgraded to match JM's version. Not using the caret as I wanted to keep it in sync with JM instead of auto bumping patch versions.

jdeichert · 2024-10-03T19:13:20Z

package.json

@@ -134,9 +132,8 @@
    "react": "^18.2.0",
    "react-dom": "18.2.0",
    "react-ga4": "^2.1.0",
-    "react-hook-form": "^7.30.0",


Unnecessary at the root level, it's a dep in both components and components-native

jdeichert · 2024-10-03T19:13:29Z

package.json

@@ -125,7 +124,6 @@
    "lodash": "^4.17.21",
    "metro-react-native-babel-preset": "^0.76.0",
    "plop": "^2.5.3",
-    "postcss": "^8.4.40",


Removed as it's not directly used... Storybook imports it as a dep.

jdeichert · 2024-10-03T19:13:49Z

package.json

@@ -69,26 +69,25 @@
    "@jobber/generators": "*",
    "@jobber/stylelint-config": "*",
    "@react-native-community/datetimepicker": "^7.1.0",
-    "@storybook/addon-actions": "7.6.11",


Upgraded more storybook-related deps to match the recently merged version bump.

jdeichert · 2024-10-03T19:14:23Z

packages/components-native/package.json

    "@types/react-native-uuid": "^1.4.0",
    "metro-react-native-babel-preset": "^0.76.0",
-    "react-test-renderer": "^18.2.0",
-    "typescript": "^4.9.5"


Typescript is shared at the root now, removed from all individual packages.

jdeichert · 2024-10-03T19:14:39Z

packages/components-native/src/InputText/InputText.tsx

@@ -400,7 +400,6 @@ function InputTextInternal(
          styleOverride?.inputText,
          loading && loadingType === "glimmer" && { color: "transparent" },
        ]}
-        // @ts-expect-error - does exist on 0.71 and up https://github.com/facebook/react-native/pull/39281


No longer necessary as we bumped react-native to match JM

jdeichert · 2024-10-03T19:14:58Z

packages/components/package.json

-    "@testing-library/jest-dom": "^5.16.5",
-    "@testing-library/react": "^14.0.0",
-    "@testing-library/react-hooks": "^7.0.2",
-    "@testing-library/user-event": "^14.5.1",


Shared at the root package.json

jdeichert · 2024-10-03T19:15:34Z

packages/design/package.json

-    "postcss": "^8.4.40",
-    "postcss-calc": "^10.0.0",
-    "postcss-cli": "^11.0.0",
-    "postcss-import": "^16.1.0",


These haven't been used directly by the design package for awhile.. probably since the big design token rewrite.

`npm i --legacy-peer-deps=true` and then another `npm i`

npm update express npm update path-to-regexp

npm update @nrwl/devkit npm update npm-registry-fetch npm update make-fetch-happen npm update socks-proxy-agent npm update socks

npm update nx

Fixes another high sev issue

jdeichert · 2024-10-03T22:26:54Z

package.json

@@ -28,7 +28,6 @@
    "lint:js": "eslint --ext .js,.jsx,.ts,.tsx . --ignore-pattern node_modules/ --ignore-pattern 'packages/design/src/assets/**'",
    "lint:markdown": "prettier --check '**/*.{md,mdx}' --write",
    "pack": "npm run bootstrap && npm pack -w",
-    "plop": "echo '🚧 `npm run plop` is now `npm run generate`'",


Upgraded plop to v4. This ^ warning has probably been around long enough, so I removed it. I can add it back if anyone depends on it 👀

jdeichert · 2024-10-03T22:27:26Z

package.json

@@ -124,19 +121,16 @@
    "lint-staged": "^9.4.2",
    "lodash": "^4.17.21",
    "metro-react-native-babel-preset": "^0.76.0",
-    "plop": "^2.5.3",


Upgraded to v4 (a few lines below)

jdeichert · 2024-10-03T22:27:36Z

package.json

    "postcss-import": "^12.0.1",
    "postcss-loader": "^4.2.0",
    "postcss-preset-env": "^8.3.0",
    "prettier": "^2.4.1",
-    "prop-types": "^15.7.2",


Unnecessary dep

jdeichert · 2024-10-03T22:29:26Z

package.json

+    "lerna": {
+      "semver": "^5.7.2 || ^6.3.1 || ^7.5.2",
+      "make-dir": {
+        "semver": "^6.3.1"
+      }
+    },


semver is one of our high severity issues (see npm audit on master). I upgraded it within a bunch of subdeps, but lerna was difficult and depends on an exact version (they are not using ^), so the only way to override it is like this.

I'll publish a pre-release to verify lerna is still working 👍

Just a comment, we may want to make a ticket for updating lerna / remove it if we want to transition later but that is a not in this PR thing

…attempt2

github-actions · 2024-10-08T18:07:24Z

Published Pre-release for 6d2c97c with versions:

  - @jobber/[email protected]+6d2c97c7
  - @jobber/[email protected]+6d2c97c7
  - @jobber/[email protected]+6d2c97c7

To install the new version(s) for Web run:

npm install @jobber/[email protected]+6d2c97c7 @jobber/[email protected]+6d2c97c7

To install the new version(s) for Mobile run:

npm install @jobber/[email protected]+6d2c97c7 @jobber/[email protected]+6d2c97c7

jdeichert · 2024-10-09T20:42:18Z

package.json

@@ -109,7 +107,6 @@
    "eslint": "^8.36.0",
    "eslint-formatter-codeframe": "^7.32.1",
    "eslint-import-resolver-alias": "^1.1.2",
-    "eslint-plugin-jest": "^22.6.4",


Used inside packages/eslint-config/package.json

Aiden-Brine · 2024-10-10T22:22:15Z

Seeing a bug on the home page when I use the pre-release on Jobber Frontend. I removed the pre-release and re-added it so I am confident the bug is related to the changes.

jdeichert · 2024-10-10T22:30:58Z

@Aiden-Brine I'm not seeing that 🤔 I tested both light and dark mode.

Are you clearing your vite cache between rebuilds by chance?

MichaelParadis · 2024-10-15T16:32:23Z

packages/components/package.json

@@ -448,10 +448,6 @@
    "@rollup/plugin-commonjs": "^25.0.7",
    "@rollup/plugin-node-resolve": "15.2.3",
    "@rollup/plugin-typescript": "^11.1.6",
-    "@testing-library/jest-dom": "^5.16.5",


Changes from the actual bundled output of components is just file renames with different hashes and updates to imports to go the the renamed files

MichaelParadis · 2024-10-16T13:49:29Z

packages/design/src/index.ts

@@ -111,8 +111,8 @@ function buildSVGStyle(
  const iconSizeStyle = iconSizes.tokens[size];
  const svgStyle: {
    fill?: string;
-    width: string | number;
-    height: string | number;
+    width: number;


Checking the compiled output for design it is the exact same except for this but there are no typescript errors caused by this change

MichaelParadis · 2024-10-16T13:50:39Z

packages/components-native/src/InputText/InputText.tsx

@@ -400,7 +400,6 @@ function InputTextInternal(
          styleOverride?.inputText,
          loading && loadingType === "glimmer" && { color: "transparent" },
        ]}
-        // @ts-expect-error - does exist on 0.71 and up https://github.com/facebook/react-native/pull/39281
        readOnly={readonly}


This is the only diff in the bundle output but there are no typescript errors caused by this

MichaelParadis · 2024-10-16T14:43:30Z

@Aiden-Brine I was unable to see this. My assumption is that some file is being caused try cleaning all of node modules and trying a new install.

MichaelParadis

LGTM!

jdeichert added 2 commits October 3, 2024 07:43

Remove unnecessary react 16 dep

2a16bee

Remove old postcss deps

4aa905f

These haven't been used directly by the design package for awhile.. probably since the big design token rewrite. Also removed from the root package.json as it isn't a direct dependency.. storybook uses it as a sub dep.

jdeichert changed the title ~~CLEANUP Clean up deps and npm audit issues part 2~~ chore: CLEANUP Clean up deps and npm audit issues part 2 Oct 3, 2024

jdeichert changed the title ~~chore: CLEANUP Clean up deps and npm audit issues part 2~~ chore: Clean up deps and npm audit issues part 2 Oct 3, 2024

jdeichert added 2 commits October 3, 2024 11:27

Sync all storybook deps to 7.6.20

690be58

Remove unnecessary dependency from root project

a8820f2

jdeichert force-pushed the CLEANUP/bumps-deps-attempt2 branch from 854958c to a8820f2 Compare October 3, 2024 18:28

Share typescript at the root

4fcf82c

jdeichert mentioned this pull request Oct 3, 2024

chore: Clean up deps and npm audit issues (attempt 1) #2056

Closed

jdeichert commented Oct 3, 2024

View reviewed changes

Update react-native to match JM

7bc23ad

jdeichert force-pushed the CLEANUP/bumps-deps-attempt2 branch from 5fea461 to 7bc23ad Compare October 3, 2024 19:11

jdeichert commented Oct 3, 2024

View reviewed changes

Remove unused prop-types package

b3285a4

jdeichert force-pushed the CLEANUP/bumps-deps-attempt2 branch from 8dbb845 to b3285a4 Compare October 3, 2024 19:24

jdeichert added 6 commits October 3, 2024 12:33

Remove unnecessary package @types/react-native

aaa2434

Reinstall with legacy peer deps

89e1cf0

`npm i --legacy-peer-deps=true` and then another `npm i`

Fix high sev issue: ws

60ef6a2

Remove duplicate eslint-plugin-jest

daac1e8

Fix a few more high sev issues

ae485e1

npm update express npm update path-to-regexp

Fix a few more high sev issues

5f4b0aa

npm update @nrwl/devkit npm update npm-registry-fetch npm update make-fetch-happen npm update socks-proxy-agent npm update socks

jdeichert added 4 commits October 3, 2024 14:12

Fix more high sev issues

bd6a48a

npm update nx

Override semver to fix high sev issue

f462b43

Override braces to fix high sev issue

3addcb3

Upgrade plop to v4

05174da

Fixes another high sev issue

jdeichert commented Oct 3, 2024

View reviewed changes

jdeichert changed the title ~~chore: Clean up deps and npm audit issues part 2~~ chore: Clean up deps and npm audit issues Oct 4, 2024

Merge remote-tracking branch 'origin/master' into CLEANUP/bumps-deps-…

e48d3ff

…attempt2

jdeichert marked this pull request as ready for review October 9, 2024 20:33

jdeichert requested a review from a team as a code owner October 9, 2024 20:33

jobbiebot bot added review requested Team Atlantis labels Oct 9, 2024

jdeichert commented Oct 9, 2024

View reviewed changes

Aiden-Brine self-requested a review October 11, 2024 20:27

MichaelParadis self-requested a review October 15, 2024 15:18

MichaelParadis reviewed Oct 15, 2024

View reviewed changes

MichaelParadis reviewed Oct 16, 2024

View reviewed changes

MichaelParadis approved these changes Oct 16, 2024

View reviewed changes

jobbiebot bot added approved and removed review requested labels Oct 16, 2024

Merge branch 'master' into CLEANUP/bumps-deps-attempt2

6d2c97c

MichaelParadis merged commit fd3222f into master Oct 16, 2024
13 checks passed

MichaelParadis deleted the CLEANUP/bumps-deps-attempt2 branch October 16, 2024 16:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Clean up deps and npm audit issues #2058

chore: Clean up deps and npm audit issues #2058

jdeichert commented Oct 3, 2024 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 3, 2024 •

edited

Loading

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

jdeichert Oct 3, 2024

MichaelParadis Oct 15, 2024

github-actions bot commented Oct 8, 2024 •

edited

Loading

jdeichert Oct 9, 2024

Aiden-Brine commented Oct 10, 2024 •

edited

Loading

jdeichert commented Oct 10, 2024

MichaelParadis Oct 15, 2024

MichaelParadis Oct 16, 2024

MichaelParadis Oct 16, 2024

MichaelParadis commented Oct 16, 2024

MichaelParadis left a comment

chore: Clean up deps and npm audit issues #2058

chore: Clean up deps and npm audit issues #2058

Conversation

jdeichert commented Oct 3, 2024 • edited Loading

Motivations

Changes

Changed

Removed

Security

Testing

cloudflare-workers-and-pages bot commented Oct 3, 2024 • edited Loading

Deploying atlantis with Cloudflare Pages

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Oct 8, 2024 • edited Loading

Choose a reason for hiding this comment

Aiden-Brine commented Oct 10, 2024 • edited Loading

jdeichert commented Oct 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MichaelParadis commented Oct 16, 2024

MichaelParadis left a comment

Choose a reason for hiding this comment

jdeichert commented Oct 3, 2024 •

edited

Loading

cloudflare-workers-and-pages bot commented Oct 3, 2024 •

edited

Loading

github-actions bot commented Oct 8, 2024 •

edited

Loading

Aiden-Brine commented Oct 10, 2024 •

edited

Loading