Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies #3

Merged
merged 10 commits into from
Jul 24, 2024
Merged

Conversation

wjt
Copy link
Contributor

@wjt wjt commented Jun 28, 2024

Currently, npm outdated shows the following:

Package          Current  Wanted  Latest  Location                      Depended by
@actions/github    4.0.0   4.0.0   6.0.0  node_modules/@actions/github  godot-asset-lib-action
@vercel/ncc       0.27.0  0.27.0  0.38.1  node_modules/@vercel/ncc      godot-asset-lib-action
axios             0.21.4  0.21.4   1.7.2  node_modules/axios            godot-asset-lib-action
prettier           2.8.8   2.8.8   3.3.2  node_modules/prettier         godot-asset-lib-action

npm audit shows:

# npm audit report

axios  0.8.1 - 0.27.2
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/axios

1 moderate severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

@actions/core is pinned to an old minor version, causing a warning to be logged on each run:

Warning: The set-output command is deprecated and will be disabled soon. Please upgrade to using Environment Files. For more information see: https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

And actions.yml specifies the node12 runtime, which has been unsupported since summer 2023: https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/.

This PR updates all dependencies to their latest versions (including new semver major versions); and updates the actions runtime to node20.

Stacked on:

@wjt
Copy link
Contributor Author

wjt commented Jun 28, 2024

I have marked this as a draft because, while I've tested the code locally with node index.js and a bunch of environment variables set to fake the GitHub Actions environment, I have not tested it in the real GitHub Actions environment.

wjt added a commit to endlessm/godot-block-coding that referenced this pull request Jun 28, 2024
@wjt wjt force-pushed the update-dependencies branch 2 times, most recently from 5351cd4 to be147e1 Compare June 28, 2024 12:37
@wjt
Copy link
Contributor Author

wjt commented Jun 28, 2024

It was surprising to me to find that the generated code is checked into the repository. (But Node is not my usual toolchain.)

I opted to update dist/ all at once in a single commit at the end of the series but I can also fold it into each commit.

wjt added a commit to endlessm/godot-block-coding that referenced this pull request Jun 28, 2024
@wjt wjt force-pushed the update-dependencies branch from be147e1 to 9cce379 Compare July 2, 2024 10:16
wjt added a commit to endlessm/godot-block-coding that referenced this pull request Jul 2, 2024
I realised that the previous pinned commit had not refreshed
dist/index.js for some of the changes.

This pinned commit corresponds to
<deep-entertainment/godot-asset-lib-action#3>.
@wjt wjt marked this pull request as ready for review July 2, 2024 10:55
@wjt
Copy link
Contributor Author

wjt commented Jul 2, 2024

I have successfully published a new release of our plugin using this branch.

@dploeger
Copy link
Contributor

@wjt I've merged the other PRs now. Is this still required? I was confused by all the PRs. 😄

@wjt
Copy link
Contributor Author

wjt commented Jul 24, 2024

It's still desirable. I'll rebase this to fix conflicts and ping you when ready.

wjt added 7 commits July 24, 2024 12:00
This is just the result of running:

    npm update

In particular, this updates @actions/core to a version new enough to use
environment files for output rather than stdout. Without this, the
following method call:

    core.setOutput('id', assetEditId)

results in the following warning:

> Warning: The `set-output` command is deprecated and will be disabled
> soon. Please upgrade to using Environment Files. For more information
> see:
> https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/
This addresses a warning that the previously-pinned version was affected
by GHSA-wf5p-g6vw-rhxx.
This fixes the following warning issued by node.js due to one of the
package's transitive dependencies:

    (node:243) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
        at node:punycode:3:9
        at BuiltinModule.compileForInternalLoader (node:internal/bootstrap/realm:398:7)
        at BuiltinModule.compileForPublicLoader (node:internal/bootstrap/realm:337:10)
        at loadBuiltinModule (node:internal/modules/helpers:96:7)
        at Module._load (node:internal/modules/cjs/loader:1063:17)
        at wrapModuleLoad (node:internal/modules/cjs/loader:212:19)
        at Module.require (node:internal/modules/cjs/loader:1297:12)
        at require (node:internal/modules/helpers:123:16)
        at Object.<anonymous> (/sysroot/home/wjt/src/deep-entertainment/godot-asset-lib-action/node_modules/whatwg-url/lib/url-state-machine.js:2:18)
        at Module._compile (node:internal/modules/cjs/loader:1460:14)
@wjt wjt force-pushed the update-dependencies branch from 9cce379 to 03ec170 Compare July 24, 2024 11:01
node12 is no longer supported by GitHub Actions; since summer 2023
actions have been run against node16 instead.

node20 is the latest supported version.

Run both the action, and the workflow which checks that the generated
code is up to date, against node20.

https://github.blog/changelog/2022-09-22-github-actions-all-actions-will-begin-running-on-node16-instead-of-node12/
@wjt wjt force-pushed the update-dependencies branch from 03ec170 to e6aed0b Compare July 24, 2024 11:05
@wjt wjt marked this pull request as draft July 24, 2024 11:06
@wjt wjt force-pushed the update-dependencies branch from e6aed0b to 190194d Compare July 24, 2024 12:21
@wjt wjt marked this pull request as ready for review July 24, 2024 12:22
@wjt
Copy link
Contributor Author

wjt commented Jul 24, 2024

This one is ready to go now. As described it updates the Node.JS runtime that the action uses, and also updates all the action's dependencies to their latest releases.

Copy link
Contributor

@dploeger dploeger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome. Thanks! 🎁

@dploeger dploeger merged commit 056fa40 into deep-entertainment:main Jul 24, 2024
1 check passed
@wjt wjt deleted the update-dependencies branch July 24, 2024 12:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants