fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures by rusackas · Pull Request #37450 · apache/superset

rusackas · 2026-01-26T17:43:09Z

Summary

This PR fixes transitive dependency resolution issues that were causing multiple Dependabot PRs to fail CI, by removing the root cause rather than just pinning versions.

The Problem

When npm regenerates the lockfile (during dependency updates), peer dependencies were resolving differently:

query-string >=5.1.1 was resolving to 9.x (ESM-only) instead of 6.x (CommonJS)
global-box was being dropped entirely from the dependency tree

This caused CI failures:

Jest: SyntaxError: Cannot use import statement outside a module
Storybook: Module not found: Error: Can't resolve 'global-box'

Root Cause

The global-box dependency came from encodable, an unmaintained library (last updated 2021) used only by the word-cloud plugin. Rather than pin global-box, we removed the dependency chain entirely.

Solution

Refactored word-cloud plugin to remove encodable dependency
- Replaced with a simple SimpleEncoder class (~90 lines)
- Uses d3-scale (already a dependency) for fontSize scaling
- Deleted configureEncodable.ts (no longer needed)
Removed unused @encodable/color from superset-ui-demo
- Was listed in package.json but never imported anywhere
Pinned query-string at 6.14.1 to prevent ESM resolution issues
- This is a peer dependency that can resolve to ESM-only 9.x

Changes

File	Change
`plugins/plugin-chart-word-cloud/src/chart/WordCloud.tsx`	Replaced encodable with SimpleEncoder
`plugins/plugin-chart-word-cloud/src/configureEncodable.ts`	Deleted
`plugins/plugin-chart-word-cloud/src/index.ts`	Removed configureEncodable export
`plugins/plugin-chart-word-cloud/src/plugin/index.ts`	Removed configureEncodable import/call
`plugins/plugin-chart-word-cloud/package.json`	Removed encodable dependency
`packages/superset-ui-demo/package.json`	Removed unused @encodable/color
`package.json`	Added query-string pin
`package-lock.json`	Regenerated (encodable & global-box removed)

Affected Dependabot PRs

Once this PR is merged, these PRs can be rebased and should pass CI:

Test Plan

Word-cloud plugin tests pass (4 tests)
TypeScript compiles without errors
CI passes on this PR
Rebase an affected Dependabot PR and verify it passes

🤖 Generated with Claude Code

…issues When npm regenerates the lockfile (e.g., during Dependabot updates), peer dependencies can be resolved to different versions: - query-string >=5.1.1 was resolving to 9.x (ESM-only) instead of 6.x - global-box was being dropped entirely from the dependency tree This caused CI failures: - Jest: SyntaxError: Cannot use import statement outside a module - Storybook: Module not found: Error: Can't resolve 'global-box' Fix by adding these as explicit dependencies with pinned versions: - query-string: 6.14.1 (CommonJS version) - global-box: 2.0.2 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

bito-code-review · 2026-01-26T17:43:20Z

Bito Automatic Review Skipped - Files Excluded

Bito didn't auto-review this change because all changed files are in the exclusion list for automatic reviews. No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the excluded files settings here, or contact your Bito workspace admin at evan@preset.io.

codeant-ai-for-open-source · 2026-01-26T17:44:21Z

Sequence Diagram

This PR pins query-string and global-box in package.json to force compatible CommonJS versions and reintroduce a missing transitive dependency, preventing CI failures caused by npm lockfile regenerations during dependency updates.

sequenceDiagram
    participant Dependabot
    participant npm
    participant CI
    participant Repo

    Dependabot->>npm: Run dependency update (regenerate lockfile)
    npm-->>Repo: Resolve deps (query-string -> 9.x (ESM), global-box dropped)
    Repo->>CI: Run tests (Jest/Storybook)
    CI-->>Dependabot: Fail (SyntaxError / Module not found)
    Repo->>Repo: Add pinned deps (query-string@6.14.1, global-box@2.0.2) in package.json
    Repo->>npm: Install & regenerate lockfile
    npm-->>CI: Resolved compatible deps
    CI-->>Dependabot: Tests pass (Dependabot PRs can be rebased)

Generated by CodeAnt AI

Copilot

Pull request overview

This PR pins query-string and global-box as top-level frontend dependencies to stabilize transitive resolution and prevent ESM/peer-dependency issues that were breaking Jest and Storybook in Dependabot PRs.

Changes:

Add global-box@2.0.2 to superset-frontend dependencies so it remains present in the dependency tree for @encodable/registry and Storybook.
Add query-string@6.14.1 (CommonJS) to superset-frontend dependencies so Jest no longer resolves to the ESM-only 9.x line.
Regenerate package-lock.json to reflect the new direct dependencies and their dependency metadata (removing obsolete "peer": true flags where these are now regular deps).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
`superset-frontend/package.json`	Adds pinned `global-box` and `query-string` as explicit runtime dependencies to control resolution.
`superset-frontend/package-lock.json`	Updates lockfile to align with the new direct dependencies and their transitive packages, ensuring consistent installs in CI.

Files not reviewed (1)

superset-frontend/package-lock.json: Language not supported

Replace the unmaintained encodable library with a simple inline encoder implementation. This eliminates the transitive dependency on global-box which was causing npm resolution issues in Dependabot PRs. Changes: - Remove encodable from plugin-chart-word-cloud dependencies - Remove @encodable/color from superset-ui-demo (was unused) - Delete configureEncodable.ts (no longer needed) - Implement SimpleEncoder class with d3-scale for fontSize scaling - Remove global-box pin from main package.json (no longer needed) - Keep query-string pinned at 6.14.1 to prevent ESM resolution issues The SimpleEncoder provides the same functionality: - Field-based data mapping for text, color, fontSize, fontFamily, fontWeight - Linear scale for fontSize with configurable range and zero option - Default values when fields are not specified This unblocks multiple Dependabot PRs that were failing due to global-box going missing during lockfile regeneration. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

The echarts plugin uses d3-array but was relying on @types/d3-array being hoisted from encodable's transitive dependencies. Now that encodable is removed, we need to declare the type dependency directly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

bito-code-review · 2026-01-26T19:07:17Z

Code Review Agent Run #16cd60

Actionable Suggestions - 0

Additional Suggestions - 1

superset-frontend/plugins/plugin-chart-word-cloud/src/chart/WordCloud.tsx - 1
- Incorrect zero value handling in font size · Line 170-170
  
  The `getFontSize` method uses `||` for default fallback, which incorrectly treats zero font sizes as falsy and replaces them with the default (20), potentially causing words with zero size data to render at default size instead of being invisible or minimal.
  Code suggestion
  @@ -166,4 +166,4 @@ - if (this.fontSizeScale) { - return this.fontSizeScale(value); - } - return value || this.defaults.fontSize; + if (this.fontSizeScale) { + return this.fontSizeScale(value); - } + return value ?? this.defaults.fontSize;

Review Details

Files reviewed - 4 · Commit Range: 23f619a..9b6a4cf
- superset-frontend/plugins/plugin-chart-word-cloud/src/chart/WordCloud.tsx
- superset-frontend/plugins/plugin-chart-word-cloud/src/configureEncodable.ts
- superset-frontend/plugins/plugin-chart-word-cloud/src/index.ts
- superset-frontend/plugins/plugin-chart-word-cloud/src/plugin/index.ts
Files skipped - 5
- superset-frontend/package-lock.json - Reason: Filter setting
- superset-frontend/package.json - Reason: Filter setting
- superset-frontend/packages/superset-ui-demo/package.json - Reason: Filter setting
- superset-frontend/plugins/plugin-chart-echarts/package.json - Reason: Filter setting
- superset-frontend/plugins/plugin-chart-word-cloud/package.json - Reason: Filter setting
Tools
- Eslint (Linter) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

github-actions · 2026-01-26T20:54:22Z

🎪 Showtime is building environment on GHA for 9b6a4cf

…pendabot CI failures (apache#37450) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

pull-request-size Bot added the size/XS label Jan 26, 2026

dosubot Bot added the dependencies:npm label Jan 26, 2026

rusackas requested review from Copilot and hainenber and removed request for hainenber January 26, 2026 17:45

Copilot started reviewing on behalf of rusackas January 26, 2026 17:46 View session

Copilot AI reviewed Jan 26, 2026

View reviewed changes

pull-request-size Bot added size/L and removed size/XS labels Jan 26, 2026

github-actions Bot added plugins packages preset-io labels Jan 26, 2026

rusackas changed the title ~~fix(deps): pin query-string and global-box to prevent ESM resolution issues~~ fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures Jan 26, 2026

rusackas requested a review from sadpandajoe January 26, 2026 20:53

rusackas added the 🎪 ⚡ showtime-trigger-start Create new ephemeral environment for this PR label Jan 26, 2026

github-actions Bot added 🎪 9b6a4cf 🚦 building 🎪 ⌛ 48h Environment expires after 48 hours (default) and removed 🎪 ⚡ showtime-trigger-start Create new ephemeral environment for this PR labels Jan 26, 2026

sadpandajoe approved these changes Jan 26, 2026

View reviewed changes

github-actions Bot removed the 🎪 9b6a4cf 🚦 building label Jan 26, 2026

github-actions Bot added 🎪 9b6a4cf 🚦 deploying and removed 🎪 9b6a4cf 🚦 deploying labels Jan 26, 2026

rusackas merged commit 7fc9974 into master Jan 26, 2026
72 of 73 checks passed

rusackas deleted the fix/pin-transitive-deps branch January 26, 2026 23:52

sadpandajoe added the 🎪 🛑 showtime-trigger-stop label Jan 29, 2026

LevisNgigi pushed a commit to LevisNgigi/superset that referenced this pull request Feb 4, 2026

fix(deps): remove encodable dependency and pin query-string to fix De…

22a7e3e

…pendabot CI failures (apache#37450) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

aminghadersohi pushed a commit to aminghadersohi/superset that referenced this pull request Mar 5, 2026

fix(deps): remove encodable dependency and pin query-string to fix De…

f96a1c4

…pendabot CI failures (apache#37450) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

alex-poor pushed a commit to alex-poor/superset that referenced this pull request Mar 15, 2026

fix(deps): remove encodable dependency and pin query-string to fix De…

586fad0

…pendabot CI failures (apache#37450) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

sadpandajoe removed 🎪 🛑 showtime-trigger-stop labels Mar 19, 2026

qfcwell pushed a commit to qfcwell/superset that referenced this pull request May 12, 2026

fix(deps): remove encodable dependency and pin query-string to fix De…

4a3e540

…pendabot CI failures (apache#37450) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures#37450

fix(deps): remove encodable dependency and pin query-string to fix Dependabot CI failures#37450
rusackas merged 3 commits into
masterfrom
fix/pin-transitive-deps

rusackas commented Jan 26, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Jan 26, 2026 •

edited

Loading

Uh oh!

codeant-ai-for-open-source Bot commented Jan 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

bito-code-review Bot commented Jan 26, 2026 •

edited

Loading

Code Review Agent Run #16cd60

Uh oh!

github-actions Bot commented Jan 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

rusackas commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

The Problem

Root Cause

Solution

Changes

Affected Dependabot PRs

Test Plan

Uh oh!

bito-code-review Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codeant-ai-for-open-source Bot commented Jan 26, 2026

Sequence Diagram

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

bito-code-review Bot commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #16cd60

Uh oh!

github-actions Bot commented Jan 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rusackas commented Jan 26, 2026 •

edited

Loading

bito-code-review Bot commented Jan 26, 2026 •

edited

Loading

bito-code-review Bot commented Jan 26, 2026 •

edited

Loading