chore: fix vulnerabilities - #796
Conversation
💡 Codex ReviewLine 284 in 18cae13  Pin tools compatible with the configured Node range
The checked html-reporter/package-lock.json Lines 24333 to 24335 in 18cae13  Restore integrity metadata in the lockfile
The regenerated lockfile drops ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
18cae13 to
c475a34
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c475a344d9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }, | ||
| "engines": { | ||
| "node": ">= 18" | ||
| "node": ">= 22.22.0" |
There was a problem hiding this comment.
Raising the package engine to Node 22.22 makes installations fail for users with engine-strict on Node 18 or 20, even though those versions were supported immediately before this commit and all production dependencies in this lockfile still support Node 18. It also conflicts with the unchanged CI matrix in .github/workflows/node.js.yml, which runs npm ci and tests on Node 18, 20, and 22.6 and builds/publishes on Node 20, as well as the Node 20 e2e workflow. Retain the prior runtime compatibility by selecting compatible development dependencies, or update the release policy and every affected workflow as an intentional breaking change.
Useful? React with 👍 / 👎.
c475a34 to
df7a4ca
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df7a4ca0e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| return runner.run((collection) => | ||
| this._tool.run(collection, {grep, sets, tag, browsers, inspectMode, devtools, replMode, local, requireModules}) | ||
| this._tool.run(collection, {grep, sets, tag, browsers, inspectMode, replMode, local, requireModules}) |
There was a problem hiding this comment.
When the GUI is invoked with Testplane's --devtools option, cliTool.devtools still reaches this adapter, but the updated call silently drops it, so the selected tests run without the requested DevTools mode. This also regresses Testplane 8 installations, which remain supported by the unchanged testplane: "*" peer range; the prior unit test explicitly verified that this option was forwarded. Keep passing devtools (extra run options are harmless to versions that do not use them), or narrow the supported Testplane range and reject the obsolete CLI option explicitly.
Useful? React with 👍 / 👎.
7637600 to
73d0003
Compare
✅ Component tests succeed
|
commit: |
✅ E2E tests succeed
|
faaa69b to
7a4c930
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a4c93079e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| strategy: | ||
| matrix: | ||
| node-version: [18.x, 20.x, 22.6] # https://github.com/nodejs/node/issues/54532 | ||
| node-version: [20.x, 22.x, 24.x] |
There was a problem hiding this comment.
The fresh evidence in the current tree is that this matrix was updated but still retains 20.x, while the same change declares Node >=22.22.0 and locks react-router@8.3.0, which has that same minimum; moreover, the Build and Publish steps at lines 31–36 run exclusively for this unsupported Node 20 job. The unchanged e2e workflow also installs and builds on Node 20, so CI continues exercising the upgraded toolchain outside its supported runtime; move these build/publish conditions and the e2e job to at least Node 22.22.
Useful? React with 👍 / 👎.
8168a67 to
cadc71e
Compare
💡 Codex ReviewLine 259 in cadc71e Preserve the legacy ReactDOM plugin surface
Custom plugins may request the explicitly whitelisted html-reporter/package-lock.json Line 4 in cadc71e Restore integrity metadata in the regenerated lockfile
The lockfile-v3 regeneration drops checksum metadata from nearly every registry package: the previous lock contained 5,498 ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
edaf92f to
4fc0544
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4fc05440a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
|
|
||
| const ANY_IMAGE_ENDING_REGEXP = new RegExp(Object.values(ImageTitleEnding).map(ending => `${ending}$`).join('|')); | ||
| const SCREENSHOT_COMPARISON_ERROR_REGEXP = /Screenshot comparison failed|expect\(.*\)\.toHaveScreenshot\(expected\) failed$/; |
There was a problem hiding this comment.
When Playwright appends comparison diagnostics or a call log after expect(...).toHaveScreenshot(expected) failed, the end-of-string anchor prevents this new alternative from matching, so genuine screenshot mismatches retain a generic error name instead of IMAGE_DIFF. The added test only covers a single-line message; match the failure header without requiring it to end the complete message.
Useful? React with 👍 / 👎.
4fc0544 to
eac33c2
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eac33c2940
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "react-checkbox-tree": "^2.0.2", | ||
| "react-clipboard.js": "^1.1.2", | ||
| "react-dom": "^18.3.1", | ||
| "react-dom": "^19.2.8", |
There was a problem hiding this comment.
Plugins that import the reporter-provided react-dom can still receive it through lib/static/modules/load-plugin.js:23-27, but this upgrade changes that public module from React DOM 18 to 19, where legacy exports such as render, hydrate, and findDOMNode were removed. Existing UI plugins compiled against the currently exposed API will therefore fail when those calls execute; keep the plugin-facing React DOM version compatible or provide a compatibility layer before upgrading the injected module.
Useful? React with 👍 / 👎.
e034c9b to
315d4d0
Compare
315d4d0 to
7dab30f
Compare
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
83683b1 to
f1ebd20
Compare
Upgrade dependencies and eliminate audited production vulnerabilities. Preserve GUI behavior, Testplane 8 devtools and screenshot compatibility. Update React types, build configuration and regression coverage. BREAKING CHANGE: require Node.js >=22.22.0; GUI extensions receive Express 5.
f1ebd20 to
1d2c28c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d2c28c744
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| buffer = Buffer.alloc(Math.min(fs.fstatSync(descriptor).size, MAX_HEADER_SIZE)); | ||
| fs.readSync(descriptor, buffer, 0, buffer.length, 0); |
There was a problem hiding this comment.
For valid JPEGs containing multiple large ICC/EXIF APP segments, the SOF dimension marker can occur after the first 512 KiB. This truncates such files before passing them to probeImageSize, causing getImageSize to throw and abort report generation, whereas the previous image-size path read the complete file. Read progressively until dimensions are found, or fall back to the complete file when the capped prefix is insufficient.
Useful? React with 👍 / 👎.
| @@ -1,6 +1,6 @@ | |||
| import path from 'path'; | |||
| import {TestCase as PlaywrightTestCase, TestResult as PlaywrightTestResult} from '@playwright/test/reporter'; | |||
| import sizeOf from 'image-size'; | |||
There was a problem hiding this comment.
image-size уже deprecated, уязвимости не пофиксятся
| } | ||
|
|
||
| const ANY_IMAGE_ENDING_REGEXP = new RegExp(Object.values(ImageTitleEnding).map(ending => `${ending}$`).join('|')); | ||
| const SCREENSHOT_COMPARISON_ERROR_REGEXP = /Screenshot comparison failed|expect\(.*\)\.toHaveScreenshot\(expected\) failed/; |
There was a problem hiding this comment.
матчимся на оба текста скриншотного падения в разных версиях pwt, чтобы правильно покрасить цвет скриншотного ретрая
| const app = App.create(args); | ||
| const server = express(); | ||
|
|
||
| server.set('query parser', 'extended'); |
There was a problem hiding this comment.
для обратной совместимости при переходе на express@5
| import {Button, Icon, Label} from '@gravity-ui/uikit'; | ||
| import {isEmpty} from 'lodash'; | ||
| import {version} from '../../../../package.json'; | ||
| import packageJson from '../../../../package.json'; |
There was a problem hiding this comment.
вебпак кидает ворнинги в старом формате:
Should not import the named export 'version' ...
(only default export is available soon)
| import {SnapshotsAction} from '@/static/modules/actions/snapshots'; | ||
| import {BrowsersAction} from '@/static/modules/actions/browsers'; | ||
|
|
||
| export type Store = Omit<typeof defaultState, 'tree'> & {tree: Tree}; |
There was a problem hiding this comment.
нигде больше не используется
| @@ -1,5 +1,6 @@ | |||
| .attempt-picker-item { | |||
| width: 28px; | |||
| border-radius: var(--g-button-border-radius, var(--g-border-radius-m)); | |||
There was a problem hiding this comment.
радиус был чуть больше, чем дефолты из гравити
| import type {ReporterTestResult} from './adapters/test-result'; | ||
|
|
||
| export const getShortMD5 = (str: string): string => { | ||
| return crypto.createHash('md5').update(str, 'ascii').digest('hex').substr(0, 7); |
There was a problem hiding this comment.
удаляем, чтобы убрать crypto-browserify из браузерной сборки
|
|
||
| await browser.$(selector).waitForDisplayed(); | ||
| await browser.waitUntil(() => browser.execute(() => document.fonts.status === 'loaded')); | ||
| await hideBottomProgressBar(browser); |
There was a problem hiding this comment.
часто тесты флапали из-за этой желтой полоски
| @@ -0,0 +1 @@ | |||
| legacy-peer-deps=true | |||
There was a problem hiding this comment.
переехали на react19, но semantic-ui-react его еще не поддерживает. В рамках PR решил не заниматься выпиливанием этого пакета, хотя пора бы его удалить
| }, | ||
| "engines": { | ||
| "node": ">= 18" | ||
| "node": ">= 22.22.0" |
There was a problem hiding this comment.
многие пакеты уже давно дропнули старые версии ноды и без этого перехода нем не избавиться от уязвимостей.
1 participant
No description provided.