Upgrade to Node 16 or 17, and Debian Bullseye to Resolve Security Issues about cadence-web HOT 6 CLOSED

Feel free to open a PR with the changes and we can take a look at the review. Thanks!

from cadence-web.

@just-at-uber thanks! Unfortunately I'm running into some issues and I'm hitting the limits of my NPM knowledge.

The following kinda works:

diff --git a/Dockerfile b/Dockerfile
index 699760b..d6ed93f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1 +1 @@
-FROM node:dubnium-stretch AS BUILD_IMAGE
+FROM node:gallium-bullseye AS BUILD_IMAGE
@@ -16 +16 @@ RUN npm run build-production
-FROM node:dubnium-slim
+FROM node:gallium-bullseye-slim
diff --git a/package.json b/package.json
index 5243165..42fafa2 100644
--- a/package.json
+++ b/package.json
@@ -31,2 +31,2 @@
-    "node": "10.22.1",
-    "npm": "6.14.4"
+    "node": "16.14.0",
+    "npm": "8.3.1"

There seem to be 2 issues:

Issue 1: code E401

If I leave package-lock.yaml in place, I get:

#11 31.95 npm ERR! code E401
#11 31.95 npm ERR! Incorrect or missing password.
#11 31.95 npm ERR! If you were trying to login, change your password, create an
#11 31.95 npm ERR! authentication token or enable two-factor authentication then
#11 31.95 npm ERR! that means you likely typed your password in incorrectly.
#11 31.96 npm ERR! Please try again, or recover your password at:
#11 31.96 npm ERR!     https://www.npmjs.com/forgot
#11 31.96 npm ERR!
#11 31.96 npm ERR! If you were doing some other operation then your saved credentials are
#11 31.96 npm ERR! probably out of date. To correct this please try logging in again with:
#11 31.96 npm ERR!     npm login

I'm not quite sure what's trying to login and what kind of credentials should be provided, but per this StackOverflow answer this is expected after a Node version upgrade, and should be resolved by deleting package-lock.yaml. However if I do that...

Issue 2: ESLint dependencies

... I get the following error:

#11 4.438 npm ERR! code ERESOLVE
#11 4.441 npm ERR! ERESOLVE unable to resolve dependency tree
#11 4.441 npm ERR!
#11 4.441 npm ERR! While resolving: [email protected]
#11 4.441 npm ERR! Found: [email protected]
#11 4.441 npm ERR! node_modules/eslint-plugin-react-hooks
#11 4.441 npm ERR!   dev eslint-plugin-react-hooks@"^2.3.0" from the root project
#11 4.441 npm ERR!
#11 4.441 npm ERR! Could not resolve dependency:
#11 4.441 npm ERR! peer eslint-plugin-react-hooks@"^4.1.0" from [email protected]
#11 4.441 npm ERR! node_modules/eslint-config-fusion
#11 4.441 npm ERR!   dev eslint-config-fusion@"^6.1.0" from the root project
#11 4.441 npm ERR!
#11 4.441 npm ERR! Fix the upstream dependency conflict, or retry
#11 4.441 npm ERR! this command with --force, or --legacy-peer-deps
#11 4.441 npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
#11 4.441 npm ERR!

It seems like there is an issue with the various ESLint dependencies, which gets surfaced when NPM tries to resolve the packages from scratch.

I can get around that and make the build work by removing all the ESLint dependencies, but I presume that's not the right way to solve this :D

Question 3

Once we manage to figure this out, the new package-lock.json seems to get created inside the container. How do we commit that back to the repo? Just copy it out of the image?

from cadence-web.

deleting package-lock is fine, it will regenerate once you npm install again.
i'm not sure how you are running the project but i would advise to git clone the repository and then delete the package-lock and then make the changes you want for node versions etc.
then "npm install"
then commit the package-lock generated.
just make sure to try running "npm run dev" locally to make sure the cadence-web project builds and starts up locally.

from cadence-web.

Actually I'm just building using Docker, i.e. doing docker build . (both to make sure that I have the right dependencies, and both not to mess up my local setup). But maybe I can just grab the file from the builder image after the build somehow.

from cadence-web.

Hey @just-at-uber, I managed to get things working on my end, and created #452

from cadence-web.

@just-at-uber - will there be a new Ubercadence-Web docker image soon with these changes? https://hub.docker.com/r/ubercadence/web hasn't been updated in over 6 months.

from cadence-web.