Skip to content

Fix npm audit CI failure - #5007

Merged
kimorris27 merged 8 commits into
masterfrom
slawande/npm-audit-fix
Jul 29, 2026
Merged

Fix npm audit CI failure#5007
kimorris27 merged 8 commits into
masterfrom
slawande/npm-audit-fix

Conversation

@slawande2

@slawande2 slawande2 commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Which issue this PR addresses:

  • Upgrade portal to React 19 + react-dom 19 + react-router 8.3.0 to resolve high-severity CVEs in react-router 6.0.0–8.2.0
    • Bump TypeScript 4.9 → 5.8 and set moduleResolution to "bundler" (required for react-router v8
      type resolution)
    • Bump Node 20 → 22 in CI workflows and Dockerfiles (required by react-router 8.3.0 engines)
    • Fix JSX.Element type imports for React 19 compatibility
    • Bump api/package-lock.json brace-expansion 5.0.7 → 5.0.8

Test plan for issue:

  • npm ci succeeds in portal/v2/ without legacy-peer-deps
  • npm audit --audit-level high --omit=dev reports 0 vulnerabilities for both portal/v2 and api
  • CI pipeline passes

Copilot AI review requested due to automatic review settings July 27, 2026 16:24
@slawande2 slawande2 added chainsaw Pull requests or issues owned by Team Chainsaw ready-for-review labels Jul 27, 2026
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR aims to resolve the portal/v2 npm audit CI failure by moving react-router out of a vulnerable version range and updating npm install behavior to allow the dependency graph to resolve.

Changes:

  • Bump portal/v2 dependency react-router from ^7.16.0 to ^8.3.0.
  • Add legacy-peer-deps=true to portal/v2/.npmrc and update portal/v2/package-lock.json accordingly.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.

File Description
portal/v2/package.json Updates react-router dependency to ^8.3.0.
portal/v2/package-lock.json Refreshes lockfile to reflect the react-router upgrade and resulting dependency graph.
portal/v2/.npmrc Adds legacy-peer-deps=true to bypass peer dependency constraints during install.
Files not reviewed (1)
  • portal/v2/package-lock.json: Generated file

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread portal/v2/package-lock.json
Comment thread portal/v2/.npmrc Outdated
Copilot AI review requested due to automatic review settings July 27, 2026 17:46
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)
  • api/package-lock.json: Generated file

Comment thread api/package-lock.json
Comment thread api/package-lock.json
Comment thread api/package-lock.json
@slawande2
slawande2 marked this pull request as draft July 27, 2026 20:21
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 21 changed files in this pull request and generated 3 comments.

Files not reviewed (2)
  • api/package-lock.json: Generated file
  • pkg/portal/assets/v2/build/static/js/520.4cbef48b.chunk.js: Generated file

Comment thread Dockerfile.ci-rp Outdated
Comment thread Dockerfile.portal_lint Outdated
Comment thread portal/v2/package.json
Copilot AI review requested due to automatic review settings July 27, 2026 22:29
@slawande2
slawande2 force-pushed the slawande/npm-audit-fix branch from e888094 to ffd4350 Compare July 27, 2026 22:29
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 12 out of 21 changed files in this pull request and generated 2 comments.

Files not reviewed (2)
  • api/package-lock.json: Generated file
  • pkg/portal/assets/v2/build/static/js/520.4cbef48b.chunk.js: Generated file
Comments suppressed due to low confidence (1)

api/package-lock.json:1092

  • @scarf/scarf was added as a dev dependency and is marked hasInstallScript: true. This means npm ci for the api/ package will execute an additional install script (potentially with network side effects), which may be undesirable in hardened/offline build environments.

Comment thread Dockerfile.portal_lint
Comment thread Dockerfile.ci-rp
Copilot AI review requested due to automatic review settings July 27, 2026 23:08
Copilot AI reviewed Jul 27, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 22 changed files in this pull request and generated 1 comment.

Files not reviewed (2)
  • api/package-lock.json: Generated file
  • pkg/portal/assets/v2/build/static/js/520.4cbef48b.chunk.js: Generated file

Comment thread cmd/aro/mirror.go
@RickARodriguez RickARodriguez mentioned this pull request Jul 28, 2026
Open
cadenmarchese
cadenmarchese reviewed Jul 28, 2026
View reviewed changes
Comment thread cmd/aro/mirror.go
Comment thread portal/v2/src/ClusterDetailListComponents/Statistics/Statistics.tsx
Comment thread cmd/aro/mirror.go
@tuxerrante
tuxerrante requested a review from Copilot July 28, 2026 15:56
@tuxerrante tuxerrante mentioned this pull request Jul 28, 2026
Open
Copilot AI reviewed Jul 28, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 22 changed files in this pull request and generated no new comments.

Files not reviewed (2)
  • api/package-lock.json: Generated file
  • pkg/portal/assets/v2/build/static/js/520.4cbef48b.chunk.js: Generated file
Comments suppressed due to low confidence (2)

api/package-lock.json:1091

  • @scarf/scarf is newly introduced as a dev dependency here and is marked with hasInstallScript: true. Because CI runs npm ci in api/ (e.g., hack/api/swagger-from-typespec.sh), this means arbitrary install scripts will execute during CI and may attempt outbound network/telemetry. If your CI egress is tightened (or if you want deterministic builds), consider explicitly disabling Scarf analytics during installs (e.g., via env like SCARF_DISABLE=1) or pinning/replacing the dependency chain to avoid adding install-script telemetry into the build.
    .github/workflows/npm-audit.yml:32
  • PR description says Node is bumped 20 → 22 in CI workflows, but this PR only updates Node versions in this workflow. ci-api-swagger-diff.yml still pins node-version: 20.12.0 (line 31). If Node 22 is now required for repo CI consistency, please update the remaining workflows too; otherwise, consider narrowing the PR description to the workflows/images that actually changed.
    - name: setup Node.JS
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: 22.22.0

cadenmarchese
cadenmarchese approved these changes Jul 28, 2026
View reviewed changes

@cadenmarchese cadenmarchese left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks OK to me - good to merge on green e2e!

shubhadapaithankar
shubhadapaithankar approved these changes Jul 28, 2026
View reviewed changes

@shubhadapaithankar shubhadapaithankar left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

ventifus
ventifus previously requested changes Jul 29, 2026
View reviewed changes

@ventifus ventifus left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like stoplight/spectral-core 1.23.1 pulls in a scarf analytics module as a dependency. Let's set export DO_NOT_TRACK=1 in our ci script per https://www.npmjs.com/package/@scarf/scarf

Copilot AI review requested due to automatic review settings July 29, 2026 13:55
Copilot AI reviewed Jul 29, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 13 out of 22 changed files in this pull request and generated no new comments.

Files not reviewed (2)
  • api/package-lock.json: Generated file
  • pkg/portal/assets/v2/build/static/js/520.4cbef48b.chunk.js: Generated file

@slawande2

slawande2 commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator Author

/azp run ci

@azure-pipelines

azure-pipelines Bot commented Jul 29, 2026

Copy link
Copy Markdown
Azure Pipelines:
No pipelines were found matching this branch/path.

kimorris27 added a commit that referenced this pull request Jul 29, 2026
@kimorris27
Update node version to align with #5007 and npm audit fix
d31c72a
@kimorris27
kimorris27 dismissed ventifus’s stale review July 29, 2026 15:52

Sanjana made the requested change.

@kimorris27
kimorris27 merged commit 5715d79 into master Jul 29, 2026
28 checks passed
@kimorris27
kimorris27 deleted the slawande/npm-audit-fix branch July 29, 2026 15:53
kimorris27 added a commit that referenced this pull request Jul 29, 2026
@kimorris27
Update node version to align with #5007 and npm audit fix
0f26bac
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments
@komidore64 komidore64 komidore64 approved these changes
@cadenmarchese cadenmarchese cadenmarchese approved these changes
@shubhadapaithankar shubhadapaithankar shubhadapaithankar approved these changes
@kimorris27 kimorris27 kimorris27 approved these changes
@ventifus ventifus ventifus left review comments
@bennerv bennerv Awaiting requested review from bennerv bennerv is a code owner
@hawkowl hawkowl Awaiting requested review from hawkowl hawkowl is a code owner
@rogbas rogbas Awaiting requested review from rogbas rogbas is a code owner
@mrWinston mrWinston Awaiting requested review from mrWinston mrWinston is a code owner
@yjst2012 yjst2012 Awaiting requested review from yjst2012 yjst2012 is a code owner
@hlipsig hlipsig Awaiting requested review from hlipsig hlipsig is a code owner
@tiguelu tiguelu Awaiting requested review from tiguelu tiguelu is a code owner
@mociarain mociarain Awaiting requested review from mociarain mociarain is a code owner
@tsatam tsatam Awaiting requested review from tsatam tsatam is a code owner
@sankur-codes sankur-codes Awaiting requested review from sankur-codes sankur-codes is a code owner
@wanghaoran1988 wanghaoran1988 Awaiting requested review from wanghaoran1988 wanghaoran1988 is a code owner
@alcasim alcasim Awaiting requested review from alcasim alcasim is a code owner
@tuxerrante tuxerrante Awaiting requested review from tuxerrante tuxerrante is a code owner
@kevinobriendotca kevinobriendotca Awaiting requested review from kevinobriendotca kevinobriendotca is a code owner

Assignees

No one assigned

Labels

chainsaw Pull requests or issues owned by Team Chainsaw ready-for-review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@slawande2 @komidore64 @ventifus @cadenmarchese @shubhadapaithankar @kimorris27