chore: bump devDeps to fix critical security vulnerability #24891

Hotell · 2022-09-21T13:23:52Z

Bumps packages that all rely directly or transitively on parse-url

workspace-tools
lage
beachball
lerna ( 2 major releases up )

bundle-size changes

1. API changes (non breaking)

Because workspace-tools introduced breaking changes ( no docs ), latest version uses git rev-parse, which relies on actual git repo presence.

version that bundle-size used (prior to this migration) https://unpkg.com/browse/[email protected]/lib/paths.js
version that bunde-size uses now (https://unpkg.com/browse/[email protected]/lib/paths.js)

-function collectLocalReport(): Promise<BundleSizeReport>
+function collectLocalReport(options?: Partial<typeof collectLocalReportDefaultOptions>): Promise<BundleSizeReport>

2. less console spam when running tests:

BEFORE:

AFTER

Related Issue(s)

Fixes https://github.com/microsoft/fluentui/security/dependabot/116

codesandbox-ci · 2022-09-21T13:37:55Z

This pull request is automatically built and testable in CodeSandbox.

To see build info of the built libraries, click here or the icon next to each commit SHA.

Latest deployment of this branch, based on commit a2f8805:

Sandbox	Source
@fluentui/react 8 starter	Configuration
@fluentui/react-components 9 starter	Configuration

size-auditor · 2022-09-21T13:39:34Z

Asset size changes

Size Auditor did not detect a change in bundle size for any component!

Baseline commit: 770c5e1841f4f0c976c2d3295667d95e930f7e3b (build)

fabricteam · 2022-09-21T13:39:51Z

Perf Analysis (`@fluentui/react-components`)

No significant results to display.

All results

Scenario	Render type	Master Ticks	PR Ticks	Iterations
Avatar	mount	1306	1319	5000
Button	mount	962	967	5000
FluentProvider	mount	1594	1576	5000
FluentProviderWithTheme	mount	631	639	10
FluentProviderWithTheme	virtual-rerender	596	597	10
FluentProviderWithTheme	virtual-rerender-with-unmount	630	640	10
MakeStyles	mount	1898	1895	50000
SpinButton	mount	2522	2526	5000

fabricteam · 2022-09-21T13:45:30Z

📊 Bundle size report

Unchanged fixtures

Package & Exports	Size (minified/GZIP)
`global-context` createContext	`533 B` `341 B`
`global-context` createContextSelector	`554 B` `348 B`
`priority-overflow` createOverflowManager	`2.936 kB` `1.212 kB`
`react-accordion` Accordion (including children components)	`78.914 kB` `24.06 kB`
`react-alert` Alert	`83.822 kB` `21.029 kB`
`react-avatar` Avatar	`48.692 kB` `13.8 kB`
`react-avatar` AvatarGroup	`14.95 kB` `5.989 kB`
`react-avatar` AvatarGroupItem	`68.66 kB` `19.138 kB`
`react-badge` Badge	`22.6 kB` `7.205 kB`
`react-badge` CounterBadge	`23.503 kB` `7.497 kB`
`react-badge` PresenceBadge	`24.05 kB` `7.067 kB`
`react-button` Button	`36.119 kB` `9.647 kB`
`react-button` CompoundButton	`43.144 kB` `10.86 kB`
`react-button` MenuButton	`38.813 kB` `10.551 kB`
`react-button` SplitButton	`46.228 kB` `11.933 kB`
`react-button` ToggleButton	`51.888 kB` `11.127 kB`
`react-card` Card - All	`67.002 kB` `19.261 kB`
`react-card` Card	`62.684 kB` `18.177 kB`
`react-card` CardFooter	`8.561 kB` `3.601 kB`
`react-card` CardHeader	`9.604 kB` `3.94 kB`
`react-card` CardPreview	`8.662 kB` `3.656 kB`
`react-combobox` Combobox (including child components)	`74.636 kB` `24.186 kB`
`react-combobox` Dropdown (including child components)	`74.236 kB` `24.086 kB`
`react-components` react-components: Accordion, Button, FluentProvider, Image, Menu, Popover	`188.681 kB` `52.366 kB`
`react-components` react-components: FluentProvider & webLightTheme	`33.394 kB` `11.007 kB`
`react-dialog` Dialog (including children components)	`82.755 kB` `24.581 kB`
`react-divider` Divider	`16.459 kB` `5.902 kB`
`react-image` Image	`10.78 kB` `4.264 kB`
`react-input` Input	`23.757 kB` `7.704 kB`
`react-label` Label	`9.338 kB` `3.86 kB`
`react-link` Link	`11.784 kB` `4.867 kB`
`react-menu` Menu (including children components)	`116.589 kB` `35.777 kB`
`react-menu` Menu (including selectable components)	`119.658 kB` `36.296 kB`
`react-overflow` hooks only	`10.685 kB` `4.104 kB`
`react-popover` Popover	`102.955 kB` `31.548 kB`
`react-portal` Portal	`10.576 kB` `3.875 kB`
`react-portal-compat` PortalCompatProvider	`5.851 kB` `1.964 kB`
`react-positioning` usePositioning	`19.7 kB` `7.404 kB`
`react-provider` FluentProvider	`15.755 kB` `5.883 kB`
`react-radio` Radio	`35.56 kB` `11.929 kB`
`react-radio` RadioGroup	`14.248 kB` `5.7 kB`
`react-select` Select	`20.846 kB` `7.346 kB`
`react-slider` Slider	`31.526 kB` `10.046 kB`
`react-spinbutton` SpinButton	`44.102 kB` `12.425 kB`
`react-spinner` Spinner	`19.977 kB` `6.438 kB`
`react-switch` Switch	`32.097 kB` `10.27 kB`
`react-text` Text - Default	`11.782 kB` `4.605 kB`
`react-text` Text - Wrappers	`15.092 kB` `5.044 kB`
`react-textarea` Textarea	`25.013 kB` `8.133 kB`
`react-theme` Single theme token import	`69 B` `89 B`
`react-theme` Teams: all themes	`29.65 kB` `6.444 kB`
`react-theme` Teams: Light theme	`17.486 kB` `5.057 kB`
`react-tooltip` Tooltip	`41.535 kB` `14.639 kB`
`react-utilities` SSRProvider	`180 B` `159 B`

_{🤖 This report was generated against 770c5e1841f4f0c976c2d3295667d95e930f7e3b}

fabricteam · 2022-09-21T13:48:05Z

Perf Analysis (`@fluentui/react-northstar`)

⚠️ 1 potential perf regressions detected

Potential regressions comparing to master

Scenario	Current PR Ticks	Baseline Ticks	Ratio	Regression Analysis
CheckboxMinimalPerf.default	1754	1711	1.03:1	analysis

Perf tests with no regressions

Scenario	Current PR Ticks	Baseline Ticks	Ratio
ButtonMinimalPerf.default	139	129	1.08:1
FlexMinimalPerf.default	247	229	1.08:1
TextMinimalPerf.default	289	273	1.06:1
AlertMinimalPerf.default	223	213	1.05:1
AttachmentSlotsPerf.default	926	885	1.05:1
HeaderMinimalPerf.default	297	284	1.05:1
RadioGroupMinimalPerf.default	367	351	1.05:1
TextAreaMinimalPerf.default	403	384	1.05:1
BoxMinimalPerf.default	280	268	1.04:1
GridMinimalPerf.default	281	270	1.04:1
ImageMinimalPerf.default	325	313	1.04:1
ListNestedPerf.default	465	447	1.04:1
AttachmentMinimalPerf.default	120	117	1.03:1
HeaderSlotsPerf.default	632	616	1.03:1
ListMinimalPerf.default	425	412	1.03:1
PopupMinimalPerf.default	533	517	1.03:1
TreeMinimalPerf.default	680	659	1.03:1
AnimationMinimalPerf.default	439	432	1.02:1
ButtonSlotsPerf.default	459	451	1.02:1
ChatDuplicateMessagesPerf.default	220	215	1.02:1
DividerMinimalPerf.default	293	287	1.02:1
DropdownManyItemsPerf.default	554	541	1.02:1
EmbedMinimalPerf.default	3074	3028	1.02:1
FormMinimalPerf.default	313	307	1.02:1
ReactionMinimalPerf.default	308	303	1.02:1
RefMinimalPerf.default	180	177	1.02:1
SliderMinimalPerf.default	1327	1306	1.02:1
TableMinimalPerf.default	330	325	1.02:1
ToolbarMinimalPerf.default	773	758	1.02:1
TreeWith60ListItems.default	131	128	1.02:1
VideoMinimalPerf.default	607	598	1.02:1
AvatarMinimalPerf.default	153	151	1.01:1
ChatMinimalPerf.default	596	588	1.01:1
DropdownMinimalPerf.default	2253	2225	1.01:1
InputMinimalPerf.default	945	936	1.01:1
ListCommonPerf.default	529	525	1.01:1
LoaderMinimalPerf.default	547	544	1.01:1
MenuButtonMinimalPerf.default	1410	1391	1.01:1
RosterPerf.default	1773	1760	1.01:1
ProviderMergeThemesPerf.default	1059	1050	1.01:1
SkeletonMinimalPerf.default	285	281	1.01:1
ButtonOverridesMissPerf.default	1082	1084	1:1
DatepickerMinimalPerf.default	4739	4733	1:1
DialogMinimalPerf.default	639	639	1:1
ItemLayoutMinimalPerf.default	961	963	1:1
LabelMinimalPerf.default	307	307	1:1
MenuMinimalPerf.default	697	696	1:1
PortalMinimalPerf.default	135	135	1:1
SplitButtonMinimalPerf.default	3632	3645	1:1
CustomToolbarPrototype.default	2215	2224	1:1
ListWith60ListItems.default	497	501	0.99:1
ProviderMinimalPerf.default	325	329	0.99:1
SegmentMinimalPerf.default	277	280	0.99:1
StatusMinimalPerf.default	548	555	0.99:1
TableManyItemsPerf.default	1535	1545	0.99:1
AccordionMinimalPerf.default	116	118	0.98:1
CardMinimalPerf.default	427	436	0.98:1
LayoutMinimalPerf.default	289	294	0.98:1
TooltipMinimalPerf.default	1951	1989	0.98:1
ChatWithPopoverPerf.default	297	305	0.97:1
IconMinimalPerf.default	516	538	0.96:1
CarouselMinimalPerf.default	360	383	0.94:1

fabricteam · 2022-09-21T14:08:44Z

Perf Analysis (`@fluentui/react`)

No significant results to display.

All results

Scenario	Render type	Master Ticks	PR Ticks	Iterations
BaseButton	mount	1506	1544	5000
Breadcrumb	mount	3598	3585	1000
Checkbox	mount	3368	3411	5000
CheckboxBase	mount	3010	3005	5000
ChoiceGroup	mount	5741	5773	5000
ComboBox	mount	1598	1592	1000
CommandBar	mount	11664	11674	1000
ContextualMenu	mount	13395	13344	1000
DefaultButton	mount	1779	1812	5000
DetailsRow	mount	4581	4621	5000
DetailsRowFast	mount	4637	4613	5000
DetailsRowNoStyles	mount	4442	4468	5000
Dialog	mount	3820	3872	1000
DocumentCardTitle	mount	729	733	1000
Dropdown	mount	4178	4177	5000
FocusTrapZone	mount	2482	2518	5000
FocusZone	mount	2413	2374	5000
GroupedList	mount	69299	80337	2
GroupedList	virtual-rerender	32465	32598	2
GroupedList	virtual-rerender-with-unmount	109128	109908	2
GroupedListV2	mount	688	699	2
GroupedListV2	virtual-rerender	660	656	2
GroupedListV2	virtual-rerender-with-unmount	675	678	2
IconButton	mount	2499	2501	5000
Label	mount	899	893	5000
Layer	mount	5369	5290	5000
Link	mount	1062	1029	5000
MenuButton	mount	2138	2134	5000
MessageBar	mount	3014	2866	5000
Nav	mount	4175	4251	1000
OverflowSet	mount	1707	1708	5000
Panel	mount	3069	3090	1000
Persona	mount	1613	1605	1000
Pivot	mount	2081	2061	1000
PrimaryButton	mount	1943	1941	5000
Rating	mount	9160	9242	5000
SearchBox	mount	1967	1972	5000
Shimmer	mount	3716	3764	5000
Slider	mount	2614	2671	5000
SpinButton	mount	5817	5976	5000
Spinner	mount	965	981	5000
SplitButton	mount	3942	3987	5000
Stack	mount	1095	1078	5000
StackWithIntrinsicChildren	mount	3156	3181	5000
StackWithTextChildren	mount	6388	6392	5000
SwatchColorPicker	mount	13287	13361	5000
TagPicker	mount	3399	3342	5000
TeachingBubble	mount	105367	105589	5000
Text	mount	972	984	5000
TextField	mount	2078	2066	5000
ThemeProvider	mount	1883	1889	5000
ThemeProvider	virtual-rerender	1317	1332	5000
ThemeProvider	virtual-rerender-with-unmount	2682	2647	5000
Toggle	mount	1416	1389	5000
buttonNative	mount	661	668	5000

Hotell · 2022-09-27T10:34:29Z

adding @layershifter as we needed to do some API gymnastics to accommodate workspace-tools breaking changes. please see more context in PR description. ty

layershifter · 2022-09-27T11:55:57Z

I was surprised that project tests did not throw, but they throw 💥 It's there:

fluentui/scripts/projects-test/packPackages.ts

Lines 1 to 4 in 770c5e1

    
           //@ts-ignore 
        
           import Project from '@lerna/project'; 
        
           //@ts-ignore 
        
           import PackageGraph from '@lerna/package-graph';

fluentui/scripts/monorepo/getDependencies.js

Lines 2 to 5 in 770c5e1

    
           // @ts-ignore 
        
           const Project = require('@lerna/project'); 
        
           // @ts-ignore 
        
           const PackageGraph = /** @type {Map<any,any>}*/ require('@lerna/package-graph');

Hotell · 2022-09-27T14:38:29Z

I was surprised that project tests did not throw, but they throw 💥 It's there:

fluentui/scripts/projects-test/packPackages.ts

Lines 1 to 4 in 770c5e1

//@ts-ignore

import Project from '@lerna/project';

//@ts-ignore

import PackageGraph from '@lerna/package-graph';

fluentui/scripts/monorepo/getDependencies.js

Lines 2 to 5 in 770c5e1

// @ts-ignore

const Project = require('@lerna/project');

// @ts-ignore

const PackageGraph = /** @type {Map<any,any>}*/ require('@lerna/package-graph');

got rid of those ts-ignores and update the API calls 🙌
a741d33

* master: (21 commits) chore: Migrate react-avatar to use new build (microsoft#24969) applying package updates chore(react-input, react-textarea): Deprecating filled with shadow appearance variants (microsoft#24900) fix: v8 Dropdown no longer sets incorrect and unnecessary aria-activedescendant (microsoft#24593) feat: v0 Tooltip migration from v9 (microsoft#24908) chore: bump devDeps to fix critical security vulnerability (microsoft#24891) Fixing Tree chart issues (microsoft#24752) init: new package react-avatar-context (microsoft#24968) ci(.github): add issues write permisions to triage-bot worflow (microsoft#24963) applying package updates fix(Toolbar): close previous submenu when opening another submenu (microsoft#24836) fix: update non-focus-trap Popover role to be group (microsoft#24897) feat: Avatar's aria label includes 'active' or 'inactive' when using the active prop (microsoft#24901) feat(scripts): implement triage-bot module (microsoft#24911) chore: bump @octokit/rest to v18 (microsoft#24919) stress test: add "build-fixture" command (microsoft#24928) BREAKING-CHANGE: new ChatMessageContent for style caching (microsoft#24691) bugfix: fix changefile to properly update version of react-components with a patch (microsoft#24949) feat(scripts): enable strict checking for additional sub-folders(packages) (microsoft#24526) chore: exports DialogContent as unstable (microsoft#24943) ...

…#24891) * chore: bump devDep to fix critical security vulnerability * generate changefile * feat(bundle-size): add options to collectLocalReport api * fixup! generate changefile * fix(scripts): remove ts-ignores and update lerna 5 apis * fixup! fix(scripts): remove ts-ignores and update lerna 5 apis

Hotell requested review from a team as code owners September 21, 2022 13:23

msft-fluent-ui-bot assigned tomi-msft Sep 21, 2022

github-actions bot added this to the September Project Cycle Q1 2022 milestone Sep 21, 2022

Hotell unassigned tomi-msft Sep 21, 2022

Hotell changed the title ~~chore: bump devDep to fix critical security vulnerability~~ chore: bump devDeps to fix critical security vulnerability Sep 21, 2022

ling1726 approved these changes Sep 26, 2022

View reviewed changes

Hotell added 4 commits September 27, 2022 11:19

chore: bump devDep to fix critical security vulnerability

b7d762e

generate changefile

ae563dc

feat(bundle-size): add options to collectLocalReport api

ef51423

fixup! generate changefile

239e5bb

Hotell force-pushed the hotell/deps/fix-critical-dependency branch from a18185b to 239e5bb Compare September 27, 2022 10:33

Hotell requested a review from layershifter September 27, 2022 10:33

layershifter approved these changes Sep 27, 2022

View reviewed changes

fix(scripts): remove ts-ignores and update lerna 5 apis

a741d33

fixup! fix(scripts): remove ts-ignores and update lerna 5 apis

a2f8805

Hotell merged commit b7fc0c2 into microsoft:master Sep 27, 2022

Hotell deleted the hotell/deps/fix-critical-dependency branch September 27, 2022 16:34

Hotell added the Area: Build System label Sep 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: bump devDeps to fix critical security vulnerability #24891

chore: bump devDeps to fix critical security vulnerability #24891

Uh oh!

Hotell commented Sep 21, 2022 •

edited

Loading

Uh oh!

codesandbox-ci bot commented Sep 21, 2022 •

edited

Loading

Uh oh!

size-auditor bot commented Sep 21, 2022 •

edited

Loading

Uh oh!

fabricteam commented Sep 21, 2022 •

edited

Loading

Uh oh!

fabricteam commented Sep 21, 2022 •

edited

Loading

Uh oh!

fabricteam commented Sep 21, 2022 •

edited

Loading

Uh oh!

fabricteam commented Sep 21, 2022 •

edited

Loading

Uh oh!

Hotell commented Sep 27, 2022

Uh oh!

layershifter commented Sep 27, 2022

Uh oh!

Hotell commented Sep 27, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

chore: bump devDeps to fix critical security vulnerability #24891

chore: bump devDeps to fix critical security vulnerability #24891

Uh oh!

Conversation

Hotell commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

bundle-size changes

1. API changes (non breaking)

2. less console spam when running tests:

Related Issue(s)

Uh oh!

codesandbox-ci bot commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

size-auditor bot commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Asset size changes

Uh oh!

fabricteam commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Perf Analysis (@fluentui/react-components)

Uh oh!

fabricteam commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Bundle size report

Uh oh!

fabricteam commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Perf Analysis (@fluentui/react-northstar)

Potential regressions comparing to master

Uh oh!

fabricteam commented Sep 21, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Perf Analysis (@fluentui/react)

Uh oh!

Hotell commented Sep 27, 2022

Uh oh!

layershifter commented Sep 27, 2022

Uh oh!

Hotell commented Sep 27, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Hotell commented Sep 21, 2022 •

edited

Loading

codesandbox-ci bot commented Sep 21, 2022 •

edited

Loading

size-auditor bot commented Sep 21, 2022 •

edited

Loading

fabricteam commented Sep 21, 2022 •

edited

Loading

Perf Analysis (`@fluentui/react-components`)

fabricteam commented Sep 21, 2022 •

edited

Loading

fabricteam commented Sep 21, 2022 •

edited

Loading

Perf Analysis (`@fluentui/react-northstar`)

fabricteam commented Sep 21, 2022 •

edited

Loading

Perf Analysis (`@fluentui/react`)