vogievetsky opened a new pull request, #20421: URL: https://github.com/apache/druid/pull/20421
### Description Follow-up to #19815. That PR fixed the open Dependabot alerts mostly by adding npm `overrides`, several of which already pinned versions that are vulnerable again, and it upgraded ECharts to v6, which changed the chart colors. This PR moves the web console onto current tooling so the overrides can go away, and restores the familiar chart colors. After this change `npm i` / `npm audit` report **0 vulnerabilities**, and `overrides` is down from 17 entries to just `@types/react`. #### Restored ECharts v5 colors ECharts 6 redesigned its built-in `dark` theme. The charts keep using the v6 `dark` theme but set the ECharts 5 series palette, background color (`#100C2A`) and brush (selection highlight) style via the new `src/utils/echarts-theme.ts` constants. Applies to the Explore bar, pie and multi-axis charts and the supervisor auto-scaler panel. #### Node 22 The Maven build (`web-console/pom.xml`) and `volta` move from Node 20.9.0 to 22.23.3 (npm 10.9.9). Newer tooling (webpack-dev-server 6, sass-loader 17) requires it. #### Dependency upgrades and cleanup - Tooling: Jest 29 → 30, css-loader 5 → 7, style-loader 2 → 4, postcss-loader 5 → 8, sass-loader 13 → 17, webpack-cli 5 → 7, webpack-dev-server 5 → 6, webpack-bundle-analyzer 4 → 5, eslint-plugin-react-hooks 5 → 7, fs-extra 8 → 11, Playwright 1.25 → 1.63. - Runtime dependencies only get in-range updates (e.g. Blueprint 5.19, axios 1.20). - Removed `@types/uuid`, `@types/classnames`, `@types/memoize-one` (the packages ship their own types) and `replace` (`script/mv` now uses plain `fs`). - `license-checker` (unmaintained) → `license-checker-rseidelsohn`, a drop-in fork. - `codecov` (deprecated uploader that hard-pins a vulnerable `js-yaml`) is no longer a devDependency. `web-checks.sh` runs it via `npx --yes [email protected]`, so the CI upload is unchanged. - Root `ajv@8` stays: without it npm hoists `ajv-keywords@5` next to `ajv@6` and webpack's options validation fails. #### Config changes required by the upgrades - `webpack.config.mjs`: - The proxy's `onProxyReq` → `on: { proxyReq }` for http-proxy-middleware 4, so `druid_cookie` keeps working. - `static.watch: false`: chokidar 5 no longer uses fsevents, and watching all of `node_modules` exhausts file handles. webpack still watches the sources. - Sass `quietDeps` + `silenceDeprecations: ['import']`: Blueprint 5 SCSS (and ours on top of it) uses `@import`. TODO: migrate with Blueprint 6. - Jest 30: `internmap` added to `transformIgnorePatterns`; `useFakeTimers('modern')` → `useFakeTimers()`; `toThrowError` → `toThrow`. Snapshots updated: Blueprint 5.19 dropped `defaultProps`, and Jest 30 changed the snapshot header link. - ESLint: disabled the new React Compiler rules `react-hooks/refs` and `react-hooks/set-state-in-effect` (with TODOs). Adopting them needs component refactors. Applied autofixes for newly flagged unnecessary type assertions. - Regenerated the license inventory and removed license files that are no longer referenced. #### Not upgraded (separate migrations) React 19, Blueprint 6, react-router 7, Prettier 3, TypeScript 7 and ESLint 10 (blocked by `eslint-plugin-react`). #### Testing - `npm run test-unit`: typecheck, ESLint, Prettier, stylelint and 159 suites / 786 tests pass. - Production build compiles with no warnings; `npm run check-licenses` passes. - E2E suite (5/5) passes against a local Druid through the dev server. - Dev server proxy verified, including `druid_cookie` forwarding. <hr> This PR has: - [x] been self-reviewed. - [x] added or updated version, license, or notice information in [licenses.yaml](https://github.com/apache/druid/blob/master/dev/license.md) - [x] added comments explaining the "why" and the intent of the code wherever would not be obvious for an unfamiliar reader. - [x] been tested in a test Druid cluster. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
