Skip to content

chore: reduce CVE surface in npm deps#7

Open
dsimansk wants to merge 4 commits into
openshift:masterfrom
dsimansk:pr/bump-deps
Open

chore: reduce CVE surface in npm deps#7
dsimansk wants to merge 4 commits into
openshift:masterfrom
dsimansk:pr/bump-deps

Conversation

@dsimansk

@dsimansk dsimansk commented Jun 22, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

  • Reduce npm CVE surface from 88 to 42 advisories (critical 1->0) by removing abandoned packages, upgrading transitive deps, and adding yarn resolutions for known vulnerabilities
  • Upgrade OCP Console SDK from 4.21 to 4.23 with peer dependency migrations: React 17->18, react-router 5->7, react-i18next 11->16, i18next 23->25, @testing-library/react 12->16
  • Remove unused Babel packages (@babel/core, @babel/preset-env, babel-loader) and Cypress with all related packages (Playwright will be used for e2e)
  • Replace custom i18n shell/JS pipeline (build-i18n.sh, lexers.js, set-english-defaults.js) with i18next-cli and a TypeScript config

Test plan

  • yarn build succeeds
  • yarn test passes
  • yarn i18n extracts locale keys correctly
  • yarn lint passes
  • npm audit shows reduced advisory count

@openshift-ci openshift-ci Bot requested review from Cragsmann and matejvasek June 22, 2026 12:43
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 22, 2026
@openshift-ci

openshift-ci Bot commented Jun 22, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dsimansk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 22, 2026
@matejvasek

matejvasek commented Jun 23, 2026

Copy link
Copy Markdown

I see this is WIP, is there more to be done?

@dsimansk

dsimansk commented Jun 23, 2026

Copy link
Copy Markdown
Author

I see this is WIP, is there more to be done?

Yep, I need a few iterations to get the correct approach. I.e. starting from console sdk bump, and then continue with what else can be updated.

@dsimansk dsimansk changed the title WIP: chore: reduce CVE surface in npm deps chore: reduce CVE surface in npm deps Jun 23, 2026
@openshift-ci openshift-ci Bot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Jun 23, 2026
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 26, 2026
@dsimansk

dsimansk commented Jun 29, 2026

Copy link
Copy Markdown
Author

/test unit

@dsimansk dsimansk force-pushed the pr/bump-deps branch 2 times, most recently from 91194cc to b3be3ad Compare June 30, 2026 21:00
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 30, 2026
@dsimansk @claude
chore: bump deps, replace Cypress with Playwright, migrate i18n tooling
7d23438 
- Migrate SDK from 4.21 to 4.23, React 17 to 18, react-router v5 to v7
- Replace Cypress e2e with Playwright: add smoke tests, remove
  integration-tests/ directory
- Replace i18next-parser with i18next-cli, remove custom i18n scripts
- Bump testing-library/dom to v10, testing-library/react to v16
- Add yarn resolutions to reduce CVE surface (launch-editor, shell-quote,
  serialize-javascript, fast-uri, ws, and others)
- Remove dead deps: babel, mocha, mochawesome, pluralize, prettier-stylelint
- Update react-router to 7.18.1 to fix 5 CVEs (RCE, open redirect, DoS, CSRF)
- Update vitest, webpack-dev-server, and other dev dependencies

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 30, 2026
dsimansk and others added 2 commits June 30, 2026 23:16
@dsimansk @claude
chore: remove i18n-scripts, add generated i18next types
a0ddec0 
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dsimansk @claude
docs: update i18n section to reflect i18next-cli migration
fb04946 
Document the switch from i18next-parser to i18next-cli for string
extraction. Add references to TypeScript type generation, the
i18next.config.ts configuration file, and CI validation of locale files.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dsimansk

dsimansk commented Jun 30, 2026

Copy link
Copy Markdown
Author

@Cragsmann I've rebase this bigger chunk of updates. It should be ready for review.

@openshift-ci

openshift-ci Bot commented Jul 1, 2026

Copy link
Copy Markdown

@dsimansk: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@twoGiants

twoGiants commented Jul 8, 2026

Copy link
Copy Markdown

/approve cancel

@twoGiants twoGiants removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Cragsmann Cragsmann Awaiting requested review from Cragsmann
@matejvasek matejvasek Awaiting requested review from matejvasek

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dsimansk @matejvasek @twoGiants