OCPBUGS-105598: Bump to @rspack/core 2.1.9 and drop "megahard" packages - #16950
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
jira/valid-reference
|
@logonoff: This pull request references Jira Issue OCPBUGS-105598, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
component/shared
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (5)
🚧 Files skipped from review as they are similar to previous changes (5)
WalkthroughFrontend dependency ranges and Rspack configuration were updated. The editor now passes high-contrast mode through PatternFly. The SDK changelog records the updated Rspack peer dependency and release references. ChangesFrontend tooling and editor updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
| "esbuild": "^0.28.1", | ||
| "follow-redirects": "^1.16.0", | ||
| "glob-parent": "^5.1.2", |
There was a problem hiding this comment.
these weren't doing anything as the packages were already in their regular semver range. there is only one other package that uses esbuild (esbuild-loader) so no need to force deduplication of that package now
|
@logonoff: This pull request references Jira Issue OCPBUGS-105598, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
logonoff
changed the title
149cbb4 to
d72280b
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Around line 68-82: Pin all changed PatternFly dependency entries in
package.json to their exact versions by removing the ^ and ~ range prefixes.
Update the corresponding selectors in frontend/yarn.lock to match those exact
versions while preserving the existing checksum entries.
- Around line 149-153: Update the frontend package engine constraint to require
Node.js >=22.12.0 instead of the broader 22.x range, and align the Node.js
version constraint or base image in Dockerfile.plugins.demo with the same
minimum. Preserve all other dependency declarations unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2c06a8ee-3eab-46ef-9418-da54a067141a
⛔ Files ignored due to path filters (1)
frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (3)
frontend/package.jsonfrontend/packages/console-shared/src/components/editor/BasicCodeEditor.tsxfrontend/rspack.config.mts
|
@logonoff: This pull request references Jira Issue OCPBUGS-105598, which is valid. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
d72280b to
8253a28
Compare
8253a28 to
8734815
Compare
openshift-ci
Bot
added
component/sdk
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@dynamic-demo-plugin/package.json`:
- Around line 20-24: Update the five dependency entries shown in package.json to
exact versions by removing caret ranges, then regenerate or edit
dynamic-demo-plugin/yarn.lock so its manifest keys and resolved versions match
the pinned dependencies.
In `@frontend/packages/console-dynamic-plugin-sdk/CHANGELOG-webpack.md`:
- Around line 13-16: Update the `@rspack/core` peer-dependency entry in the
4.23.0-prerelease.6 changelog to match getWebpackPackage’s generated manifest:
use the documented minimum version 2.1.9 or the range >=2.1.9 instead of ^2.1.9.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 01949214-2dfc-4822-87a2-33d846801160
⛔ Files ignored due to path filters (1)
dynamic-demo-plugin/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (2)
dynamic-demo-plugin/package.jsonfrontend/packages/console-dynamic-plugin-sdk/CHANGELOG-webpack.md
| "@patternfly/react-core": "^6.6.1", | ||
| "@patternfly/react-icons": "^6.6.1", | ||
| "@patternfly/react-table": "^6.6.1", | ||
| "@rspack/cli": "^2.1.9", | ||
| "@rspack/core": "^2.1.9", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
packages=(
'`@patternfly/react-core`|6.6.1'
'`@patternfly/react-icons`|6.6.1'
'`@patternfly/react-table`|6.6.1'
'`@rspack/cli`|2.1.9'
'`@rspack/core`|2.1.9'
)
for entry in "${packages[@]}"; do
IFS='|' read -r name version <<< "$entry"
payload="$(jq -n \
--arg name "$name" \
--arg version "$version" \
'{package: {name: $name, ecosystem: "npm"}, version: $version}')"
echo "OSV: $name@$version"
curl -fsS -X POST \
-H 'Content-Type: application/json' \
--data "$payload" \
https://api.osv.dev/v1/query |
jq '{vulnerabilities: [.vulns[]? | {id, modified}]}'
encoded_name="${name//\//%2f}"
echo "Registry metadata: $name@$version"
curl -fsS "https://registry.npmjs.org/${encoded_name}/${version}" |
jq '{license, integrity: .dist.integrity}'
done
echo "Lockfile entries and checksums:"
rg -n -C 2 '(`@patternfly/react-core`|`@patternfly/react-icons`|`@patternfly/react-table`|`@rspack/cli`|`@rspack/core`|checksum:)' \
dynamic-demo-plugin/yarn.lock
echo "CI supply-chain controls:"
rg -n -i 'sbom|provenance|attestation|cosign|sigstore' .github frontend dynamic-demo-plugin || trueRepository: openshift/console
Length of output: 50374
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- manifest ---'
cat -n dynamic-demo-plugin/package.json | sed -n '1,45p'
printf '%s\n' '--- focused lockfile records ---'
awk '
/^"(`@patternfly`\/react-core|`@patternfly`\/react-icons|`@patternfly`\/react-table|`@rspack`\/cli|`@rspack`\/core)`@npm`:/ {
show=1; n=0
}
show {
print
n++
if (n >= 18) show=0
}
' dynamic-demo-plugin/yarn.lock
printf '%s\n' '--- focused supply-chain references ---'
rg -n -i -m 120 'sbom|software bill|provenance|attestation|cosign|sigstore|slsa|cyclonedx|spdx' \
.github dynamic-demo-plugin frontend 2>/dev/null || true
printf '%s\n' '--- package-manager integrity settings ---'
rg -n -i -m 80 'checksumBehavior|npmRegistryServer|npmAlwaysAuth|npmAudit|integrity|checksum' \
.yarnrc.yml dynamic-demo-plugin .github 2>/dev/null || trueRepository: openshift/console
Length of output: 23735
Pin the five dependencies to exact versions.
Replace the caret ranges with exact versions and align dynamic-demo-plugin/yarn.lock with the resulting manifest keys and reviewed resolutions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@dynamic-demo-plugin/package.json` around lines 20 - 24, Update the five
dependency entries shown in package.json to exact versions by removing caret
ranges, then regenerate or edit dynamic-demo-plugin/yarn.lock so its manifest
keys and resolved versions match the pinned dependencies.
Source: Path instructions
| ## 4.23.0-prerelease.6 - TBD | ||
|
|
||
| - Minimum compatible version of `@rspack/core` peer dependency increased to `^2.1.9` ([OCPBUGS-105598], [#16950]) | ||
|
|
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
Match the documented peer range to the generated manifest.
getWebpackPackage publishes @rspack/core with a >= range. With the repository minimum at 2.1.9, the generated contract is >=2.1.9, not ^2.1.9. Document 2.1.9 as the minimum version or use >=2.1.9 for the range.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/packages/console-dynamic-plugin-sdk/CHANGELOG-webpack.md` around
lines 13 - 16, Update the `@rspack/core` peer-dependency entry in the
4.23.0-prerelease.6 changelog to match getWebpackPackage’s generated manifest:
use the documented minimum version 2.1.9 or the range >=2.1.9 instead of ^2.1.9.
|
/lgtm |
|
/verified by ci |
openshift-ci-robot
added
the
verified
|
@logonoff: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: logonoff, vojtechszocs The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Scheduling tests matching the |
|
@logonoff: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
a9c6d3b
into
openshift:main
|
@logonoff: Jira Issue Verification Checks: Jira Issue OCPBUGS-105598 Jira Issue OCPBUGS-105598 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
3 participants
Analysis / Root cause:
Solution description:
isHighContrastThemeprop from patternfly feat(CodeEditor): add isHighContrastTheme patternfly/patternfly-react#12384react-routerdue to feat: warn on unknown import.meta properties web-infra-dev/rspack#14785Summary by CodeRabbit
Bug Fixes
Chores