Skip to content

Upgrade npm packages#27869

Merged
wendigo merged 1 commit intotrinodb:masterfrom
gertjanal:npm-upgrades
Jan 13, 2026
Merged

Upgrade npm packages#27869
wendigo merged 1 commit intotrinodb:masterfrom
gertjanal:npm-upgrades

Conversation

@gertjanal
Copy link
Copy Markdown
Contributor

@gertjanal gertjanal commented Jan 7, 2026

Description

npm audit fix

Validated, everything seems to work

Release notes

( X ) This is not user-visible or is docs only, and no release notes are required.
( ) Release notes are required. Please propose a release note for me.
( ) Release notes are required, with the following suggested text:

@cla-bot cla-bot bot added the cla-signed label Jan 7, 2026
@github-actions github-actions bot added the ui Web UI label Jan 7, 2026
@gertjanal gertjanal marked this pull request as ready for review January 10, 2026 20:45
@gertjanal gertjanal requested a review from koszti January 10, 2026 20:45
@koszti koszti mentioned this pull request Jan 10, 2026
@koszti
Copy link
Copy Markdown
Member

koszti commented Jan 10, 2026

This is somewhat related to and partially addressed by #27632.

I’m generally in favor of running npm audit fix (and npm update) regularly but it raises the question of how we want to handle vulnerabilities going forward. From what I can see in the main trino java codebase we usually bump dependencies one by one in separate commits which doesn’t align with how npm commands operates. Do we want to adopt them or prefer more safe and semi-manual one-dependency-per-commit approach? cc @mosabua

UPDATE: I had another look, react bump isn't covered by this PR so please ignore that.

@wendigo
Copy link
Copy Markdown
Contributor

wendigo commented Jan 13, 2026

@koszti updating one-by-one would be nice. We can enable dependabot for npm packages

@wendigo wendigo merged commit 8afea93 into trinodb:master Jan 13, 2026
100 checks passed
@github-actions github-actions bot added this to the 480 milestone Jan 13, 2026
@gertjanal gertjanal deleted the npm-upgrades branch March 10, 2026 22:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

3 participants