CB-14145 resolve npm audit issues in patch fix #50

brodycj · 2018-07-06T23:15:38Z

Platforms affected

mac OS ("osx")

What does this PR do?

Set VERSION to 4.0.2-dev & update JS snapshot to version 4.0.2-dev via coho, using local coho with Improve patch release support cordova-coho#176 for patch release support (another workaround fix pushed to Improve patch release support cordova-coho#176 was needed to get the JS snapshot to work with old version of cordova-js). Note that the indentation of package.json was changed by use of a recent version of coho.
Update the following dependencies, pinned in this patch fix, to resolve the npm audit issues:
- cordova-common@2.2.5
- ~~xcode@1.0.0~~ xcode@0.9.3 (same as cordova-ios)
explicit plist@2.1.0 dependency in this patch fix (wanted since plist is explicitly used by code in bin ref: [WIP] Major release TODO WIP #49)
pin other external dependencies in this patch fix
use jasmine-node@^1.5.0 in devDependencies to resolve npm audit warning in this patch fix
completely reinstall node_modules in this patch fix (ignoring node_modules/.bin) using the following command on npm@6.1.0: npm install --only=production:
Update CordovaLib/cordova.js from cordova-js versions 4.2.0, 4.2.2, and 4.2.4
update bundledDependencies to support deprecated Node.js 4 in this patch fix
remove extra devDependencies: coffee-script, nodeunit, uncrustify ([WIP] Major release TODO WIP #49)
fixes ported from master:
- CB-12762: package.json reference repo on github
- migrate jshint -> eslint, with some more eslint rules turned off in this patch fix
add line spacing to .eslintrc.yml ([WIP] Major release TODO WIP #49)
enable eslint in tests/spec ~~(with some eslint rules turned off in tests/spec for now)~~ and resolve eslint issues in tests/spec ([WIP] Major release TODO WIP #49)

What testing has been done on this change?

npm audit with ~~npm@6.1.0~~ npm@6.2.0 (latest release) shows 0 vulnerabilities
npm outdated shows no red entries
npm test succeeds locally
cordova platform add brodybits/cordova-osx#cb-14145-patch to new Cordova project and then cordova run osx succeeds on deprecated Node.js 4 (npm@2.15.11) and Node.js 8 (npm@5.6.0)
cordova platform add brodybits/cordova-osx#cb-14145-patch to new Cordova project and then run from Xcode succeeds on deprecated Node.js 4 (npm@2.15.11)
cordova platform add brodybits/cordova-osx#cb-14145-patch to new Cordova project and then cordova build osx succeeds on deprecated Node.js 4 (npm@2.15.11)
~~TODO: check that Travis CI which includes npm test task passes~~ (skipping this step since other changes would be needed for this project to pass its tests on Travis CI)

Checklist

Reported an issue in the JIRA database
Commit message follows the format: "CB-3232: (android) Fix bug with resolving file paths", where CB-xxxx is the JIRA ID & "android" is the platform affected. (with some exceptions)
~~Added automated test coverage as appropriate for this change.~~

* CB-3785: enable EventListener interface support * CB-3785: Channel.prototype.subscribe to support EventListener interface * CB-9967 deleted legacy platform specific files from cordova-js * CB-11522 [windows] Make cordova-js handle 'unknown' type * CB-11522 Make utils.clone handle properties gracefully

from cordova-js@4.2.2

update from cordova-js@4.2.4

- coffee-script - nodeunit - uncrustify and move tmp to end of the list

Co-authored-by: Audrey So <audreyso@apache.org> Co-authored-by: Christopher J. Brody <chris.brody@gmail.com>

in devDependencies to resolve some npm audit warnings

resolves some npm audit warnings with changes by @brodybits (Christopher J. Brody): - .eslintrc.yml turn off more eslint rules in 4.0.x patch release - package.json skip eslint on tests (disabled in .eslintignore) Co-authored-by: Audrey So <audreyso@apache.org> Co-authored-by: Christopher J. Brody <chris.brody@gmail.com>

with some eslint rules turned off

Outdated Cordova dependencies not included: - cordova-common - xcode (from apache/cordova-node-xcode)

remove: - /node_modules add: - node_modules/.bin - package-lock.json - tests/cdv-test-project/node_modules/* - tests/cdv-test-project/package.json

- lodash-node - lodash - os-homedir - os-tmpdir - osenv

purplecabbage

All sounds good to me. The changed file list was so large I was not able to see it all, but it seems a large amount of this is just node_modules updates. Any chance we can stop bundling to clean some of this up?

brodycj · 2018-07-09T15:13:47Z

Any chance we can stop bundling to clean some of this up?

Bundling is done to support Node.js 4, which we know is deprecated but cannot be dropped in a patch release. Hope we can remove the bundled node_modules from master in the near future for major release.

For this kind of a change I would generally suggest checking each of the individual commits.

Thanks @purplecabbage!

brodycj · 2018-07-10T00:52:48Z

I would like to make one more update to include xcode@1.0.1 with [dev] audit fixes in apache/cordova-node-xcode#10. Apologies for any possible confusion.

tripodsan · 2018-07-10T02:41:33Z

can't we fix this together with #48 and #49 to get rid of the bundled node_modules ?

dpogue · 2018-07-10T02:42:41Z

We will remove the bundled node_modules in the next major version, but we can't do that in a patch release because it breaks compatibility with older versions of the cordova tooling.

- cordova-common@2.2.5 - xcode@0.9.3 (same as cordova-ios@4.5.5)

in dependencies (explicitly used by some scripts in bin/templates/scripts/cordova/lib)

installed by using the following command with npm@6.2.0: npm i --only=production with the following artifacts ignored: node_modules/.bin/* package-lock.json

(needed to support the deprecated Node.js 4 version)

Needed to clear the red highlights in npm outdated --depth=0

brodycj · 2018-07-30T03:02:13Z

Merged with a couple more updates:

using xcode@0.9.3 (same as cordova-ios@4.5.5)
resolve eslint issues in tests/spec

Also checked that npm outdated shows no red entries, other test items repeated.

See updated description for more details.

Christopher J. Brody and others added 8 commits July 6, 2018 16:46

Update JS snapshot to version 4.0.2-dev (via coho)

358826c

Set VERSION to 4.0.2-dev (via coho)

7ff625c

CB-12895: cordova.js updates to pass eslint

5a890f7

from cordova-js@4.2.2

CB-9366 log error.stack in cordova.js

7546cf0

update from cordova-js@4.2.4

package.json remove extra devDeps (4.0.x)

872a3cb

- coffee-script - nodeunit - uncrustify and move tmp to end of the list

CB-12762: package.json reference repo on github (4.0.x)

f0375a8

Co-authored-by: Audrey So <audreyso@apache.org> Co-authored-by: Christopher J. Brody <chris.brody@gmail.com>

CB-14145 update jasmine-node@^1.5.0 (4.0.x)

3829638

in devDependencies to resolve some npm audit warnings

brodycj force-pushed the cb-14145-patch branch from b805b0b to e0021a0 Compare July 8, 2018 19:05

audreyso and others added 7 commits July 8, 2018 15:50

.eslintrc.yml vertical spacing (4.0.x)

722a7d7

enable eslint in tests/spec (4.0.x)

97bf081

with some eslint rules turned off

package.json pin external dependencies (4.0.x)

eee3870

Outdated Cordova dependencies not included: - cordova-common - xcode (from apache/cordova-node-xcode)

.gitignore updates for 4.0.x

6b9d868

remove: - /node_modules add: - node_modules/.bin - package-lock.json - tests/cdv-test-project/node_modules/* - tests/cdv-test-project/package.json

CB-14145 remove old node_modules no longer needed

a31f98b

- lodash-node - lodash - os-homedir - os-tmpdir - osenv

CB-14145 remove other node_modules fore patch fix

901e887

brodycj force-pushed the cb-14145-patch branch from e0021a0 to 69bc4b6 Compare July 8, 2018 20:00

brodycj requested review from shazron, purplecabbage, dpogue and raphinesse July 8, 2018 22:32

purplecabbage approved these changes Jul 9, 2018

View reviewed changes

Christopher J. Brody added 4 commits July 29, 2018 18:53

CB-14145 update dependencies to fix audit in 4.0.x

35191f6

- cordova-common@2.2.5 - xcode@0.9.3 (same as cordova-ios@4.5.5)

package.json explicitly pin plist@2.1.0 (4.0.x)

5b87610

in dependencies (explicitly used by some scripts in bin/templates/scripts/cordova/lib)

CB-14145 update node_modules in 4.0.x only

85cf4de

installed by using the following command with npm@6.2.0: npm i --only=production with the following artifacts ignored: node_modules/.bin/* package-lock.json

package.json update bundledDependencies in 4.0.x

9e96456

(needed to support the deprecated Node.js 4 version)

Christopher J. Brody added 2 commits July 29, 2018 21:52

pin more added bundled dependencies in 4.0.x only

01ce5ef

Needed to clear the red highlights in npm outdated --depth=0

resolve eslint issues in tests/spec

d4e3b30

brodycj force-pushed the cb-14145-patch branch from 69bc4b6 to d4e3b30 Compare July 30, 2018 02:17

brodycj merged commit 08c5083 into apache:4.0.x Jul 30, 2018

brodycj deleted the cb-14145-patch branch July 30, 2018 03:00

brodycj mentioned this pull request Jul 30, 2018

CB-14228 release 4.0.2 #51

Merged

6 tasks

brodycj removed request for shazron, dpogue and raphinesse August 1, 2018 21:24

brodycj mentioned this pull request Aug 2, 2018

[WIP] Platform Release: Improve patch and dev version support apache/cordova-coho#188

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CB-14145 resolve npm audit issues in patch fix #50

CB-14145 resolve npm audit issues in patch fix #50

brodycj commented Jul 6, 2018 •

edited

Loading

purplecabbage left a comment

brodycj commented Jul 9, 2018

brodycj commented Jul 10, 2018 •

edited

Loading

tripodsan commented Jul 10, 2018

dpogue commented Jul 10, 2018

brodycj commented Jul 30, 2018

CB-14145 resolve npm audit issues in patch fix #50

CB-14145 resolve npm audit issues in patch fix #50

Conversation

brodycj commented Jul 6, 2018 • edited Loading

Platforms affected

What does this PR do?

What testing has been done on this change?

Checklist

purplecabbage left a comment

Choose a reason for hiding this comment

brodycj commented Jul 9, 2018

brodycj commented Jul 10, 2018 • edited Loading

tripodsan commented Jul 10, 2018

dpogue commented Jul 10, 2018

brodycj commented Jul 30, 2018

brodycj commented Jul 6, 2018 •

edited

Loading

brodycj commented Jul 10, 2018 •

edited

Loading