[FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718

mehdid93 · 2024-12-02T10:55:59Z

Follow up of https://issues.apache.org/jira/browse/FLINK-36739
Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

What is the purpose of the change

This PR aims to bump some dependencies version in order to address critical/high vulnerabilities after the merge of NodeJS v22 which is required to have these changes.

Before the PR
37 vulnerabilities (3 low, 14 moderate, 17 high, 3 critical)

After the PR
8 moderate severity vulnerabilities

Brief change log

Update of the dependencies
Fix css layout for Jobs after the update

Verifying this change

This change is a trivial rework / code cleanup without any test coverage.

Does this pull request potentially affect one of the following parts:

Dependencies (does it add or upgrade a dependency): yes
The public API, i.e., is any changed class annotated with @Public(Evolving): no
The serializers: no
The runtime per-record code paths (performance sensitive): no
Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
The S3 file system connector: no

Documentation

Does this pull request introduce a new feature? no
If yes, how is the feature documented? not applicable

flinkbot · 2024-12-02T10:59:10Z

CI report:

2844e97 Azure: SUCCESS

Bot commands

The @flinkbot bot supports the following commands:

@flinkbot run azure re-run the last Azure build

mehdid93 · 2024-12-04T14:34:53Z

@MartijnVisser I've raised this PR for upgrading dependencies to solve critical/high severities in case you may not have the notification

simplejason · 2024-12-05T03:25:32Z

flink-runtime-web/web-dashboard/package.json

+    "@angular/forms": "^18.2.12",
+    "@angular/platform-browser": "^18.2.12",
+    "@angular/platform-browser-dynamic": "^18.2.12",
+    "@angular/router": "^18.2.12",


You can rebase the latest code, currently the front-end dependencies have been upgraded in this PR #25713

@simplejason Thank you, rebased the PR to take these changes

davidradl · 2024-12-05T09:06:11Z

Reviewed by Chi on 05/12/24. Asked submitter questions
@mehdid93 once you have rebased, @rmetzger suggested you test:

different browsers
large log files
flame graphs
metrics
subtask metrics

davidradl · 2024-12-05T10:14:25Z

@mehdid93 will #25740 and #25741 be solved by this ?

mehdid93 · 2024-12-05T10:25:18Z

@mehdid93 will #25740 and #25741 be solved by this ?

Hi @davidradl I've checked package-lock.json of this PR and seems to be the same version as raised by these two PRs so yes It will be solved by this PR

Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

… angular v18 See https://www.npmjs.com/package/@testing-library/angular#user-content-version-compatibility Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

This change is no longer needed after the merge of apache#25713 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 · 2024-12-06T10:01:28Z

Reviewed by Chi on 05/12/24. Asked submitter questions @mehdid93 once you have rebased, @rmetzger suggested you test:

different browsers

large log files

flame graphs

metrics

subtask metrics

Thanks @davidradl
Non-regression tests were done using Safari/Google Chrome/Mozilla Firefox and there is not spotted issue.

rmetzger

Great contribution, thanks a lot!

I've also tested the Web UI with this PR and couldn't find any regressions.
I found one thing that needs to be addressed with this PR as well, even though I think similar PRs in the recent past haven't addressed this -- so even better to address it now:
We are maintaining a NOTICE file which lists all dependencies and dep versions we are using for legal compliance reasons.
Many JS dependencies are packaged and distributed (in a minified version) as part of Flink releases. With this legal documentation, we want to make sure that companies using Flink, or distributing Flink don't get into trouble for not listing which open source dependencies they are using.
https://github.com/apache/flink/blob/master/flink-runtime-web/src/main/resources/META-INF/NOTICE

I'm not entirely sure how this list got initially created there. Maybe npm has a method of listing all dependencies?

mehdid93 · 2024-12-11T10:14:09Z

Thanks a lot @rmetzger.
I've searched for how we modify the NOTICE file but looks like we may need Blackduck to generate the report if I'm right ?
If it's Blackduck is there a way to have it because I seen that it paid software but we may ask support to have a licence for oss or there is another way to do ?

rmetzger · 2024-12-11T12:32:39Z

Hey, thanks a lot for looking into this. This might indeed be generated from Blackduck. I used to have an employer with a black duck license.
Have you looked in something like this https://www.npmjs.com/package/license-report?
My current employer is using https://fossa.com/, maybe I can use that to generate a report -- but it would be better for OS Flink if we use something OS. Ideally we document it in the flink-runtime-webui/readme.
Would be great if you could take a look into this, otherwise, I'll try fossa (timebox the effort :) )

mehdid93 · 2024-12-11T14:05:58Z

Hey, thanks a lot for looking into this. This might indeed be generated from Blackduck. I used to have an employer with a black duck license. Have you looked in something like this https://www.npmjs.com/package/license-report? My current employer is using https://fossa.com/, maybe I can use that to generate a report -- but it would be better for OS Flink if we use something OS. Ideally we document it in the flink-runtime-webui/readme. Would be great if you could take a look into this, otherwise, I'll try fossa (timebox the effort :) )

Sure! I'll look for packages that offer the same content as Blackduck.

rmetzger · 2024-12-11T14:13:39Z

Doesn't have to be exactly the same -- as long as the package name, version and the license is included

mehdid93 · 2024-12-11T16:23:51Z

I've tried several NPM packages to extract licenses and here are the output of two dependencies.
@rmetzger Do you want to proceed with one of these or we should check another package ?

licence-report

department  related to  name                               license period  material / not material  license type  link                                                remote version  installed version  defined version  author
----------  ----------  ----                               --------------  -----------------------  ------------  ----                                                --------------  -----------------  ---------------  ------
kessler     stuff       @angular/animations                perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/common                    perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/compiler                  perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/core                      perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/forms                     perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/platform-browser          perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/platform-browser-dynamic  perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @angular/router                    perpetual       material                 MIT           git+https://github.com/angular/angular.git          18.2.13         18.2.13            ^18.2.13         angular
kessler     stuff       @antv/g2                           perpetual       material                 MIT           git+https://github.com/antvis/g2.git                4.2.11          4.2.8              ^4.1.34          https://github.com/orgs/antvis/people
kessler     stuff       core-js                            perpetual       material                 MIT           git+https://github.com/zloirock/core-js.git         3.39.0          3.39.0             ^3.39.0          Denis Pushkarev [email protected] http://zloirock.ru
kessler     stuff       d3                                 perpetual       material                 ISC           git+https://github.com/d3/d3.git                    7.9.0           7.4.4              ^7.1.1           Mike Bostock https://bost.ocks.org/mike
kessler     stuff       d3-flame-graph                     perpetual       material                 Apache-2.0    git+https://github.com/spiermar/d3-flame-graph.git  4.1.3           4.1.3              ^4.1.1           Martin Spier <[email protected]>
kessler     stuff       d3-tip                             perpetual       material                 MIT           git+https://github.com/Caged/d3-tip.git             0.9.1           0.9.1              ^0.9.1           Justin Palmer <[email protected]> (http://labratrevenge.com/d3-tip)
kessler     stuff       dagre                              perpetual       material                 MIT           git+https://github.com/dagrejs/dagre.git            0.8.5           0.8.5              ^0.8.5           Chris Pettitt <[email protected]>
kessler     stuff       monaco-editor                      perpetual       material                 MIT           git+https://github.com/microsoft/monaco-editor.git  0.31.1          0.31.1             ^0.31.1          Microsoft Corporation
kessler     stuff       ng-zorro-antd                      perpetual       material                 MIT           git+https://github.com/NG-ZORRO/ng-zorro-antd.git   18.2.1          18.2.1             ^18.2.1          n/a
kessler     stuff       rxjs                               perpetual       material                 Apache-2.0    git+https://github.com/reactivex/rxjs.git           7.8.1           7.8.1              ^7.5.7           Ben Lesh <[email protected]>
kessler     stuff       tslib                              perpetual       material                 0BSD          git+https://github.com/Microsoft/tslib.git          2.8.1           2.6.3              ^2.0.0           Microsoft Corp.
kessler     stuff       zone.js                            perpetual       material                 MIT           git://github.com/angular/angular.git                0.14.10         0.14.10            ~0.14.10         Brian Ford

@wbmnky/license-report-generator

Dependency Licenses

flink-dashboard (2.0.0)

Generated at: Wed Dec 11 2024 17:05:38 GMT+0100 (Central European Standard Time)

Package Name	Version	URL	Description	License
@angular/animations	18.2.13	-	Angular - animations integration with web-animations	MIT
@angular/cdk	18.2.14	https://github.com/angular/components#readme	Angular Material Component Development Kit	MIT
@angular/common	18.2.13	-	Angular - commonly needed directives and services	MIT
@angular/compiler	18.2.13	-	Angular - the compiler library	MIT
@angular/core	18.2.13	-	Angular - the core framework	MIT
@angular/forms	18.2.13	-	Angular - directives and services for creating forms	MIT
@angular/platform-browser	18.2.13	-	Angular - library for using Angular in a web browser	MIT
@angular/platform-browser-dynamic	18.2.13	-	Angular - library for using Angular in a web browser with JIT compilation	MIT
@angular/router	18.2.13	https://github.com/angular/angular/tree/main/packages/router	Angular - the routing library	MIT
@ant-design/colors	7.1.0	https://github.com/ant-design/ant-design-colors#readme	Color palettes calculator of Ant Design	MIT
@ant-design/icons-angular	18.0.0	-	-	MIT
@antv/adjust	0.2.5	-	The adjust module for G2, F2.	MIT
@antv/attr	0.3.3	-	The Attribute module for G2, F2.	MIT
@antv/color-util	2.0.6	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@antv/component	0.8.28	-	The component module for antv	MIT
@antv/coord	0.3.1	-	The coordinate module for G2	MIT
@antv/dom-util	2.0.4	https://github.com/antvis/util#readme	A common util collection for antv projects	MIT
@antv/event-emitter	0.1.3	-	event emitter for antvis.	MIT
@antv/g-base	0.5.16	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@antv/g-canvas	0.5.12	https://github.com/antvis/g#readme	A canvas library which providing 2d	ISC
@antv/g-math	0.1.9	https://github.com/antvis/util#readme	geometry math	ISC
@antv/g-svg	0.5.6	https://github.com/antvis/g#readme	A canvas library which providing 2d	ISC
@antv/g2	4.2.8	https://g2.antv.vision	the Grammar of Graphics in Javascript	MIT
@antv/matrix-util	3.0.4	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@antv/matrix-util	3.1.0-beta.3	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@antv/path-util	2.0.15	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@antv/scale	0.3.18	-	The scale module for G2	MIT
@antv/util	2.0.17	https://github.com/antvis/util#readme	A common util collection for antv projects	ISC
@babel/code-frame	7.26.2	https://babel.dev/docs/en/next/babel-code-frame	Generate errors that contain a code frame that point to source locations.	MIT
@babel/helper-validator-identifier	7.25.9	-	Validate identifier/keywords name	MIT
@babel/runtime	7.25.0	https://babel.dev/docs/en/next/babel-runtime	babel's modular runtime helpers	MIT
@babel/runtime	7.26.0	https://babel.dev/docs/en/next/babel-runtime	babel's modular runtime helpers	MIT
@ctrl/tinycolor	3.6.1	https://tinycolor.vercel.app	Fast, small color manipulation and conversion for JavaScript	MIT
@testing-library/dom	10.4.0	https://github.com/testing-library/dom-testing-library#readme	Simple and complete DOM testing utilities that encourage good testing practices.	MIT
@types/aria-query	5.0.4	https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/aria-query	TypeScript definitions for aria-query	MIT
@types/d3-timer	2.0.1	https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/d3-timer	TypeScript definitions for d3JS d3-timer module	MIT
@types/node	22.10.1	https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node	TypeScript definitions for node	MIT
ansi-regex	5.0.1	-	Regular expression for matching ANSI escape codes	MIT
ansi-styles	4.3.0	-	ANSI escape codes for styling strings in the terminal	MIT
ansi-styles	5.2.0	-	ANSI escape codes for styling strings in the terminal	MIT
aria-query	5.3.0	https://github.com/A11yance/aria-query#readme	Programmatic access to the ARIA specification	Apache-2.0
chalk	4.1.2	-	Terminal string styling done right	MIT
color-convert	2.0.1	-	Plain color conversion functions	MIT
color-name	1.1.4	https://github.com/colorjs/color-name	A list of color names and its values	MIT
commander	7.2.0	-	the complete solution for node.js command-line programs	MIT
core-js	3.39.0	-	Standard library	MIT
csstype	3.1.1	-	Strict TypeScript and Flow types for style based on MDN data	MIT
d3	7.4.4	https://d3js.org	Data-Driven Documents	ISC
d3-array	3.1.6	https://d3js.org/d3-array/	Array manipulation, ordering, searching, summarizing, etc.	ISC
d3-axis	3.0.0	https://d3js.org/d3-axis/	Displays automatic reference lines for scales.	ISC
d3-brush	3.0.0	https://d3js.org/d3-brush/	Select a one- or two-dimensional region using the mouse or touch.	ISC
d3-chord	3.0.1	https://d3js.org/d3-chord/	Visualize relationships or network flow with an aesthetically-pleasing circular layout.	ISC
d3-collection	1.0.7	https://d3js.org/d3-collection/	Handy data structures for elements keyed by string.	BSD-3-Clause
d3-color	3.1.0	https://d3js.org/d3-color/	Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).	ISC
d3-contour	3.0.1	https://d3js.org/d3-contour/	Compute contour polygons using marching squares.	ISC
d3-delaunay	6.0.2	https://github.com/d3/d3-delaunay	Compute the Voronoi diagram of a set of two-dimensional points.	ISC
d3-dispatch	3.0.1	https://d3js.org/d3-dispatch/	Register named callbacks and call them with arguments.	ISC
d3-drag	3.0.0	https://d3js.org/d3-drag/	Drag and drop SVG, HTML or Canvas using mouse or touch input.	ISC
d3-dsv	3.0.1	https://d3js.org/d3-dsv/	A parser and formatter for delimiter-separated values, such as CSV and TSV	ISC
d3-ease	1.0.7	https://d3js.org/d3-ease/	Easing functions for smooth animation.	BSD-3-Clause
d3-ease	3.0.1	https://d3js.org/d3-ease/	Easing functions for smooth animation.	BSD-3-Clause
d3-fetch	3.0.1	https://d3js.org/d3-fetch/	Convenient parsing for Fetch.	ISC
d3-flame-graph	4.1.3	https://github.com/spiermar/d3-flame-graph#readme	A d3.js library to produce flame graphs.	Apache-2.0
d3-force	3.0.0	https://d3js.org/d3-force/	Force-directed graph layout using velocity Verlet integration.	ISC
d3-format	3.1.0	https://d3js.org/d3-format/	Format numbers for human consumption.	ISC
d3-geo	3.0.1	https://d3js.org/d3-geo/	Shapes and calculators for spherical coordinates.	ISC
d3-hierarchy	3.1.2	https://d3js.org/d3-hierarchy/	Layout algorithms for visualizing hierarchical data.	ISC
d3-interpolate	3.0.1	https://d3js.org/d3-interpolate/	Interpolate numbers, colors, strings, arrays, objects, whatever!	ISC
d3-path	3.0.1	https://d3js.org/d3-path/	Serialize Canvas path commands to SVG.	ISC
d3-polygon	3.0.1	https://d3js.org/d3-polygon/	Operations for two-dimensional polygons.	ISC
d3-quadtree	3.0.1	https://d3js.org/d3-quadtree/	Two-dimensional recursive spatial subdivision.	ISC
d3-random	3.0.1	https://d3js.org/d3-random/	Generate random numbers from various distributions.	ISC
d3-scale	4.0.2	https://d3js.org/d3-scale/	Encodings that map abstract data to visual representation.	ISC
d3-scale-chromatic	3.0.0	https://d3js.org/d3-scale-chromatic/	Sequential, diverging and categorical color schemes.	ISC
d3-selection	1.4.2	https://d3js.org/d3-selection/	Data-driven DOM manipulation: select elements and join them to data.	BSD-3-Clause
d3-selection	3.0.0	https://d3js.org/d3-selection/	Data-driven DOM manipulation: select elements and join them to data.	ISC
d3-shape	3.1.0	https://d3js.org/d3-shape/	Graphical primitives for visualization, such as lines and areas.	ISC
d3-time	3.0.0	https://d3js.org/d3-time/	A calculator for humanity’s peculiar conventions of time.	ISC
d3-time-format	4.1.0	https://d3js.org/d3-time-format/	A JavaScript time formatter and parser inspired by strftime and strptime.	ISC
d3-timer	1.0.10	https://d3js.org/d3-timer/	An efficient queue capable of managing thousands of concurrent animations.	BSD-3-Clause
d3-timer	3.0.1	https://d3js.org/d3-timer/	An efficient queue capable of managing thousands of concurrent animations.	ISC
d3-tip	0.9.1	https://github.com/Caged/d3-tip	Tooltips for d3 svg visualizations	MIT
d3-transition	3.0.1	https://d3js.org/d3-transition/	Animated transitions for D3 selections.	ISC
d3-zoom	3.0.0	https://d3js.org/d3-zoom/	Pan and zoom SVG, HTML or Canvas using mouse or touch input.	ISC
dagre	0.8.5	-	Graph layout for JavaScript	MIT
date-fns	2.30.0	-	Modern JavaScript date utility library	MIT
delaunator	5.0.0	-	An incredibly fast JavaScript library for Delaunay triangulation of 2D points	ISC
dequal	2.0.3	-	A tiny (304B to 489B) utility for check for deep equality	MIT
detect-browser	5.3.0	https://github.com/DamonOehlman/detect-browser	Unpack a browser type and version from the useragent string	MIT
dom-accessibility-api	0.5.16	-	Implements https://w3c.github.io/accname/	MIT
entities	4.5.0	-	Encode & decode XML and HTML entities with ease & speed	BSD-2-Clause
fecha	4.2.3	https://github.com/taylorhakes/fecha	Date formatting and parsing	MIT
gl-matrix	3.4.3	http://glmatrix.net	Javascript Matrix and Vector library for High Performance WebGL apps	MIT
graphlib	2.1.8	-	A directed and undirected multi-graph library	MIT
has-flag	4.0.0	-	Check if argv has a specific flag	MIT
iconv-lite	0.6.3	https://github.com/ashtuchkin/iconv-lite	Convert character encodings in pure javascript.	MIT
internmap	2.0.3	https://github.com/mbostock/internmap/	Map and Set with automatic key interning	ISC
js-tokens	4.0.0	-	A regex that tokenizes JavaScript.	MIT
lodash	4.17.21	https://lodash.com/	Lodash modular utilities.	MIT
lz-string	1.5.0	http://pieroxy.net/blog/pages/lz-string/index.html	LZ-based compression algorithm	MIT
monaco-editor	0.31.1	-	A browser based code editor	MIT
ng-zorro-antd	18.2.1	https://ng.ant.design	An enterprise-class UI components based on Ant Design and Angular	MIT
parse5	7.2.1	https://parse5.js.org	HTML parser and serializer.	MIT
picocolors	1.1.1	-	The tiniest and the fastest library for terminal output formatting with ANSI colors	ISC
pretty-format	27.5.1	-	Stringify any JavaScript value.	MIT
react-is	17.0.2	https://reactjs.org/	Brand checking of React Elements.	MIT
regenerator-runtime	0.14.1	-	Runtime for Regenerator-compiled generator and async functions.	MIT
robust-predicates	3.0.1	-	Fast robust predicates for computational geometry	Unlicense
rw	1.3.3	https://github.com/mbostock/rw	Now stdin and stdout are files.	BSD-3-Clause
rxjs	7.8.1	https://rxjs.dev	Reactive Extensions for modern JavaScript	Apache-2.0
safer-buffer	2.1.2	-	Modern Buffer API polyfill without footguns	MIT
supports-color	7.2.0	-	Detect whether a terminal supports color	MIT
tslib	1.14.1	https://www.typescriptlang.org/	Runtime library for TypeScript helper functions	0BSD
tslib	2.6.3	https://www.typescriptlang.org/	Runtime library for TypeScript helper functions	0BSD
undici-types	6.20.0	https://undici.nodejs.org	A stand-alone types package for Undici	MIT
zone.js	0.14.10	-	Zones for JavaScript	MIT

rmetzger · 2024-12-12T14:46:40Z

Thanks a lot.
Do you know why @wbmnky/license-report-generator has so much more? Is it possible that @wbmnky/license-report-generator includes transitive dependencies, while licence-report does only direct?

Does any of the tools also include copies of the actual licenses used?
As you can see here: https://github.com/apache/flink/blob/master/flink-runtime-web/src/main/resources/META-INF/NOTICE we are including the license texts in the file as well, because basically all OS licenses require to ship a copy of the license as well.

rmetzger · 2024-12-12T14:47:44Z

I personally like the @wbmnky/license-report-generator report more, the other report has some fields I don't understand, like department, license period, material / not material(I mean I have an idea, but that info is not needed for our purposes)

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 · 2024-12-13T12:40:10Z

@rmetzger Thanks for your response and yes it's possible to update the template to include copies of the actual licenses used.
I've modified the default output template and updated the NOTICE and added a script for further updates.

mehdid93 · 2024-12-13T12:41:52Z

I personally like the @wbmnky/license-report-generator report more, the other report has some fields I don't understand, like department, license period, material / not material(I mean I have an idea, but that info is not needed for our purposes)

This package also support the output template so we get rid of these columns but it seems that he's limited to only direct dependencies (same result with option --only=prod,opt,peer cf: https://www.npmjs.com/package/license-report#select-dependencies)

rmetzger · 2024-12-13T12:54:08Z

flink-runtime-web/src/main/resources/META-INF/NOTICE

-flink-runtime-web
-Copyright 2014-2024 The Apache Software Foundation
-
-This product includes software developed at
-The Apache Software Foundation (http://www.apache.org/).


Can you preserve this header in the NOTICE file (it is common in all Flink modules)?

Sorry for this. I've restored this header in NOTICE file and updated the template to handle it.

rmetzger · 2024-12-13T12:54:33Z

flink-runtime-web/src/main/resources/META-INF/NOTICE

+| undici-types | 6.20.0 | MIT |
+| zone.js | 0.14.10 | MIT |
+
+
+## Licenses:
+@angular/[email protected]
+---
+The MIT License
+
+Copyright (c) 2010-2024 Google LLC. https://angular.dev/license
+
+Permission is hereby granted, free of charge, to any person obtaining a copy


This layout and output of the module is perfect!

Can you add instructions on how to generate those to the README.md file of flink-runtime-web?

Thanks @rmetzger. I've added instructions to the README.md on how to generate the NOTICE

rmetzger · 2024-12-13T12:55:21Z

flink-runtime-web/web-dashboard/dev/notice-template

@@ -0,0 +1,12 @@
+# Dependency Licenses


I guess the header I mentioned should go here

Should be fixed :)

rmetzger · 2024-12-13T12:55:28Z

flink-runtime-web/web-dashboard/dev/generate_notice.sh

+if ! npm list -g @wbmnky/license-report-generator > /dev/null
+then
+  npm install -g @wbmnky/license-report-generator
+fi
+
+devDir=$(cd "$(dirname "$0")" && pwd)
+(cd "${devDir}/.." && license-report-generator --depth Infinity \
+                         --template-file "notice-template" --template-dir "${devDir}" \
+                         --out-dir "${devDir}/../../src/main/resources/META-INF" --out-file "NOTICE")


Great idea to add a script!

rmetzger · 2024-12-13T12:56:05Z

Perfect, thanks a lot. This is almost ready to be merged!

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 · 2024-12-13T14:16:11Z

Perfect, thanks a lot. This is almost ready to be merged!

Thanks a lot @rmetzger I've made the changes, do I need to squash the commits ?

rmetzger · 2024-12-13T18:45:45Z

flink-runtime-web/src/main/resources/META-INF/NOTICE

+| pretty-format | 27.5.1 | MIT |
+| react-is | 17.0.2 | MIT |
+| regenerator-runtime | 0.14.1 | MIT |
+| robust-predicates | 3.0.1 | Unlicense |


Just for future reference: this license is ok for ASF projects: https://www.apache.org/legal/resolved.html#category-a

rmetzger · 2024-12-13T18:47:51Z

I'm sorry that this drags on for so long: the flink-runtime-web/web-dashboard/dev/notice-template is causing the compile step to fail on CI, bc it lacks the license header.
Can you exclude the file from the license check (rat plugin) in the pom.xml file?

rmetzger · 2024-12-13T18:48:08Z

do I need to squash the commits ?

No, I can do it while merging.

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

rmetzger · 2024-12-16T10:19:33Z

Thanks. Let's get this in once CI has passed.

mehdid93 · 2024-12-16T10:54:46Z

Thanks. Let's get this in once CI has passed.

Thank you Robert. Juste seen that the compile_ci stage is green sounds like it's fixed 🎉

rmetzger

Thanks a lot for your contribution -- merging the PR!

…ulnerabilities (apache#25718) Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

…ulnerabilities (#25718) Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

…ulnerabilities (apache#25718) Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

…ulnerabilities (#25718) Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

…ulnerabilities (apache#25718) Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 marked this pull request as draft December 2, 2024 11:23

flinkbot added the component=Runtime/WebFrontend label Dec 2, 2024

mehdid93 marked this pull request as ready for review December 2, 2024 14:40

simplejason reviewed Dec 5, 2024

View reviewed changes

This was referenced Dec 5, 2024

Bump d3-color, @antv/g-base and d3-interpolate in /flink-runtime-web/web-dashboard #25740

Closed

Bump ws and socket.io in /flink-runtime-web/web-dashboard #25741

Closed

[FLINK-36740] Update frontend dependencies to address vulnerabilities

08bfcc5

Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 force-pushed the FLINK-36740 branch 2 times, most recently from ab30a12 to 8f15db1 Compare December 5, 2024 10:39

[FLINK-36740] Fix linting issue with new version of dependencies

a2eb559

Follow up of https://issues.apache.org/jira/browse/FLINK-36739 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

mehdid93 force-pushed the FLINK-36740 branch from 8f15db1 to a2eb559 Compare December 5, 2024 11:05

mehdid93 added 2 commits December 5, 2024 12:36

[FLINK-36740] Update the version of @testing-library/angular to match…

8025771

… angular v18 See https://www.npmjs.com/package/@testing-library/angular#user-content-version-compatibility Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

[FLINK-36740] remove css change

0df42fa

This change is no longer needed after the merge of apache#25713 Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

rmetzger reviewed Dec 9, 2024

View reviewed changes

[FLINK-36740] NOTICE update and add script for further updates

1014d81

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

rmetzger reviewed Dec 13, 2024

View reviewed changes

[FLINK-36740] Update README and update the notice-template and NOTICE

5e66070

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

rmetzger reviewed Dec 13, 2024

View reviewed changes

[FLINK-36740] Exclude notice-template from licence check

2844e97

Contribute-to: https://issues.apache.org/jira/browse/FLINK-36740

rmetzger approved these changes Dec 17, 2024

View reviewed changes

rmetzger merged commit 1c2ec06 into apache:master Dec 17, 2024

mehdid93 mentioned this pull request Dec 20, 2024

[BP-1.20][FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25830

Merged

mehdid93 mentioned this pull request Jan 7, 2025

[BP-1.19][FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25914

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718

[FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718

mehdid93 commented Dec 2, 2024 •

edited

Loading

flinkbot commented Dec 2, 2024 •

edited

Loading

mehdid93 commented Dec 4, 2024

simplejason Dec 5, 2024

mehdid93 Dec 5, 2024

davidradl commented Dec 5, 2024

davidradl commented Dec 5, 2024

mehdid93 commented Dec 5, 2024

mehdid93 commented Dec 6, 2024

rmetzger left a comment

mehdid93 commented Dec 11, 2024 •

edited

Loading

rmetzger commented Dec 11, 2024

mehdid93 commented Dec 11, 2024

rmetzger commented Dec 11, 2024

mehdid93 commented Dec 11, 2024

rmetzger commented Dec 12, 2024

rmetzger commented Dec 12, 2024

mehdid93 commented Dec 13, 2024

mehdid93 commented Dec 13, 2024 •

edited

Loading

rmetzger Dec 13, 2024

mehdid93 Dec 13, 2024

rmetzger Dec 13, 2024 •

edited

Loading

mehdid93 Dec 13, 2024

rmetzger Dec 13, 2024

mehdid93 Dec 13, 2024

rmetzger Dec 13, 2024

rmetzger commented Dec 13, 2024

mehdid93 commented Dec 13, 2024 •

edited

Loading

rmetzger Dec 13, 2024

rmetzger commented Dec 13, 2024

rmetzger commented Dec 13, 2024

rmetzger commented Dec 16, 2024

mehdid93 commented Dec 16, 2024 •

edited

Loading

rmetzger left a comment

[FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718

[FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718

Conversation

mehdid93 commented Dec 2, 2024 • edited Loading

What is the purpose of the change

Brief change log

Verifying this change

Does this pull request potentially affect one of the following parts:

Documentation

flinkbot commented Dec 2, 2024 • edited Loading

CI report:

mehdid93 commented Dec 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

davidradl commented Dec 5, 2024

davidradl commented Dec 5, 2024

mehdid93 commented Dec 5, 2024

mehdid93 commented Dec 6, 2024

rmetzger left a comment

Choose a reason for hiding this comment

mehdid93 commented Dec 11, 2024 • edited Loading

rmetzger commented Dec 11, 2024

mehdid93 commented Dec 11, 2024

rmetzger commented Dec 11, 2024

mehdid93 commented Dec 11, 2024

Dependency Licenses

flink-dashboard (2.0.0)

Generated at: Wed Dec 11 2024 17:05:38 GMT+0100 (Central European Standard Time)

rmetzger commented Dec 12, 2024

rmetzger commented Dec 12, 2024

mehdid93 commented Dec 13, 2024

mehdid93 commented Dec 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rmetzger Dec 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

rmetzger commented Dec 13, 2024

mehdid93 commented Dec 13, 2024 • edited Loading

Choose a reason for hiding this comment

rmetzger commented Dec 13, 2024

rmetzger commented Dec 13, 2024

rmetzger commented Dec 16, 2024

mehdid93 commented Dec 16, 2024 • edited Loading

rmetzger left a comment

Choose a reason for hiding this comment

mehdid93 commented Dec 2, 2024 •

edited

Loading

flinkbot commented Dec 2, 2024 •

edited

Loading

mehdid93 commented Dec 11, 2024 •

edited

Loading

mehdid93 commented Dec 13, 2024 •

edited

Loading

rmetzger Dec 13, 2024 •

edited

Loading

mehdid93 commented Dec 13, 2024 •

edited

Loading

mehdid93 commented Dec 16, 2024 •

edited

Loading