ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies - #703
ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies#703Brijesh619 wants to merge 8 commits into
Conversation
|
|
|
We can currently solve 0 of the remaining 3 vulnerabilities without causing major issues for this PR. Here is exactly why we can't safely fix them right now: quill (1 vuln): There is simply no patched version published on npm yet for this specific advisory (GHSA-v3m3-f69x-jf25). We are physically unable to fix it until the package maintainers release a patch. |
d2a353c to
fbd566d
Compare
|
Note: |
|
|
|
|
|
| payload?: T; | ||
| } | ||
|
|
||
| export const getPayloadFromRechartsEvent = <T>(item: unknown): T | undefined => { |
There was a problem hiding this comment.
getPayloadFromRechartsEvent is a good abstraction used across multiple chart components. Please add unit tests covering: valid payload object, null/undefined input, primitive input, and object without payload key. Also consider using this helper in EntityStatusDonut.tsx (line 109) for consistency.
| onMouseEnter={(_, index) => setActiveIndex(index)} | ||
| onMouseLeave={() => setActiveIndex(-1)} | ||
| onClick={(data) => handleStatusClick(data.name as "Active" | "Shell" | "Deleted")} | ||
| onClick={(data: unknown) => { |
There was a problem hiding this comment.
Pie onClick uses inline type casting (data as { name?: string }) instead of the shared getPayloadFromRechartsEvent helper introduced in this PR. Using the helper would reduce duplication and align with ClassificationDistributionCard / EntityTypeBarChart.
| await user.click(screen.getByTestId('bar')); | ||
| expect(mockNavigateToClassificationSearch).not.toHaveBeenCalled(); | ||
| }); | ||
| }); |
There was a problem hiding this comment.
EntityTypeBarChart.test.tsx covers Y-axis label click, keyboard Enter/Space, and empty-label guard cases. Consider adding equivalent tests here for handleLabelClick on the Y-axis custom tick renderer to maintain parity.
| // using string matching for '#d3d3d3' | ||
| expect(colorBox).toHaveStyle({ backgroundColor: "#d3d3d3" }); | ||
| }); | ||
| }); |
There was a problem hiding this comment.
Consider adding a test for keyboard interaction on legend ButtonBase (Enter/Space key) to verify the accessibility refactor, and a negative case where onLegendClick is not called on invalid input.
| aria-label={String(entry.value)} | ||
| className="legend-button" | ||
| > | ||
| <Box className="legend-color-box" style={{ backgroundColor: entry.color }} /> |
There was a problem hiding this comment.
Legend color box still uses inline style={{ backgroundColor: entry.color }}. Since legend colors are dynamic (active vs inactive), this may be intentional — but consider using a CSS custom property (style={{ '--legend-color': entry.color }}) with a SCSS rule, or document why inline style is required here.
2 participants
What changes were proposed in this pull request?
This PR resolves ATLAS-5348 by upgrading several outdated frontend transitive dependencies in the Atlas React UI (
/dashboard).Previously, this patch relied heavily on manual
overridesinpackage.jsonto bump specific sub-dependencies. However, forcing those overrides (likeminimatch,js-yaml, andpostcss) caused "invalid tree" errors and forced modern tooling (like Vite and ESLint) backward.Instead, this PR safely updates
package-lock.json, upgrades the main libraries responsible for bringing in vulnerable sub-dependencies, and only uses an override when strictly necessary to avoid breaking changes.Main Library Upgrades:
recharts(bumped to^3.10.1): Resolves thelodashvulnerability by removing older dependencies (likevictory-vendor).react-quill-new(bumped to^3.8.3): Resolves thelodash-esvulnerability.Recharts v3 Migration & Code Quality Improvements:
Because upgrading to Recharts v3 introduced significant API changes, this PR includes a comprehensive refactor of the dashboard's charting components to ensure production stability, strict type safety, and accessibility:
anytypes and redundant inline casting across all chart components (ClassificationDistributionCard,EntityStatsChart,EntityStatusDonut,EntityTypeBarChart,MessageConsumptionChart). Recharts click event payloads are now centrally validated using a new genericgetPayloadFromRechartsEvent<T>helper inmetricsUtils.ts, ensuring strict type safety and eliminating code duplication.<Tooltip>and<LabelList>components to comply with the stricter v3formattersignatures (RenderableText), and removed the manualactiveIndexstate from<Pie>which is now handled natively.<Legend>implementation inEntityStatsChart. The legacypayloadmanipulation was replaced with a customcontentrenderer utilizing native MUI<ButtonBase>components memoized viauseCallback. This restores native keyboard accessibility (Enter/Spacekeys) and semantic ARIA roles without customonKeyDownhandlers. Payload parsing is wrapped inuseMemoto prevent array reallocations.sxprops, dynamic object-basedstyle={{ backgroundColor }}objects (e.g., inEntityStatusDonut), and inline<XAxis>/<YAxis>label configurations across all charting components. These were fully migrated to semantic SCSS classes withinstats.scss(e.g.,.donut-status-active,.chart-axis-label). We also removed hardcoded styling values (e.g.,#fff,#333,#1a1a1a) from stylesheets to allow MUI layout components (<Paper>) and<Typography>to organically inherit theme tokens, ensuring native dark mode compatibility.EntityStats.test.tsxto correctly query the new custom Legend DOM structure (data-testid="legend-Active") and assert on visibility toggles. Additionally, introduced extensive dedicated test suites (EntityStatusDonut.test.tsx,ClassificationDistributionCard.test.tsx,EntityTypeBarChart.test.tsx, andEntityStatsChart.test.tsx) to ensure 100% coverage on pie slice and bar chart navigation, missing payload guards, tooltip interactions, and edge cases.Overrides Added:
d3-color(Override added for3.1.0): Mitigates a High-severity ReDoS vulnerability. We opted for an override here because upgrading the maind3library from v5 to v7 introduces significant architectural breaking changes to the graph components.(Note: Prior overrides for
brace-expansion,js-yaml,postcss,semver,minimatch,lodash, andlodash-eswere removed as they are either resolved via the upgrades above or were creating invalid dependency trees).This PR also incorporates fixes for the following automated Dependabot PRs targeting the dashboard:
(Note: Dependabot PRs #644 (qs) and #584 (serialize-javascript / webpack) which targeted /dashboard/src/views/Lineage/atlas-lineage are now obsolete. That sub-directory and its package files were deleted in commit ATLAS-5328.)
Known / Unresolved Issues & Deferred Upgrades
While running
npm audit, there are a few items intentionally excluded from this PR:1. Deferred to Separate Jiras (Breaking Changes):
react-router-dom: Upgrading this package to v7 involves significant architectural changes and deprecations that introduce breaking issues in the current test suite. This migration has been isolated into its own Jira to be handled carefully without blocking these security patches.sanitize-html: Upgrading this library from v1 to v2 introduces breaking ESM syntax via its underlyinghtmlparser2dependency, causing the Jest test environment to completely crash. This will be handled in a separate Jira so we can properly implement Jest mocks and isolated testing.2. No Patched Version Available:
quill(=2.0.3): There is currently 1 low-severity vulnerability flagged for this package. However, 2.0.3 is currently the latest version available on npm. There is no patched version available yet, so this cannot be resolved until the maintainers release a newer update.How was this patch tested?
npm auditlocally in the/dashboarddirectory to verify that all fixable warnings (that do not cause breaking framework issues) have been successfully cleared andnpm lsreturns a perfectly valid dependency tree.npm run build,npm run typecheck, andnpm run lintto ensure the React UI complies strictly with TypeScript configurations without emitting any warnings or errors.npm run test(Jest + React Testing Library) to verify all 4,872 assertions continue to pass successfully, explicitly verifying that the Recharts v3 custom Legend DOM interactions execute correctly, missing payload scenarios fail gracefully, and label formatters work reliably.