Revert "chore(studio-deps)(deps): bump the security-critical group across 1 directory with 9 updates"

[robfrank]

Reverts #2439

[gemini-code-assist]

Summary of Changes

Hello @robfrank, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a full revert of a previous dependency update that aimed to bump a group of security-critical packages. The primary purpose of this revert is to address potential issues or incompatibilities that arose from the recent upgrade. The changes involve downgrading several front-end libraries, notably Bootstrap and various DataTables components, to their prior stable versions. This action ensures the stability and functionality of the studio module by rolling back to known working dependency configurations.

Highlights

• Bootstrap Downgrade: The bootstrap library has been reverted to an earlier version, specifically from 5.3.7 to 5.3.3 (in package.json) and 5.3.6 (in package-lock.json).
• DataTables Downgrade: All datatables.net related packages, including datatables.net, datatables.net-bs5, datatables.net-buttons, datatables.net-buttons-bs5, datatables.net-responsive, datatables.net-responsive-bs5, datatables.net-select, and datatables.net-select-bs5, have been reverted to their previous major versions.
• Dependency Manifest Updates: The studio/package.json and studio/package-lock.json files have been updated to reflect the downgraded dependency versions, ensuring the project uses the specified older versions.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request reverts a previous dependency upgrade for bootstrap and the datatables.net suite. This is likely being done to address regressions introduced by the upgrade. While reverting is a valid strategy to restore stability, it's important to acknowledge that this re-introduces the security vulnerabilities the original upgrade was meant to patch. My review highlights the security implications and recommends creating follow-up tasks to ensure these dependencies are updated securely as soon as possible.

[gemini-code-assist]

Reverting bootstrap from ^5.3.7 to ^5.3.3 likely re-introduces security vulnerabilities that were addressed in the newer version. Given that the original update was for security reasons, it's critical to create a follow-up task to upgrade this dependency again as soon as the regressions are resolved.

[gemini-code-assist]

Downgrading the datatables.net suite of packages re-introduces the security vulnerabilities that the original upgrade aimed to fix. It's critical to create a follow-up issue to track the effort of re-upgrading these dependencies once the regressions they introduced are understood and can be worked around. Leaving the application on these older versions poses a security risk.

[codacy-production]

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
Report missing for 60caacb1	✅ ∅

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (60caacb)	Report Missing	Report Missing	Report Missing
Head commit (135b5f8)	70751	44740	63.24%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#2440)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings    Change summary preferences

Footnotes

1. Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct. ↩