Skip to content

feat: Upgrade deps (clear 52 Dependabot alerts) #11853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ovr merged 11 commits into from
Sep 18, 2026
Merged

feat: Upgrade deps (clear 52 Dependabot alerts) #11853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
508bc38
fix(deps): Raise the lodash resolution to ^4.18.0
ovr Sep 11, 2026
acfddb5
fix(deps): Bump express to 4.22.2 and float compression
ovr Sep 11, 2026
b49bc41
fix(deps): Bump testcontainers to 12 to clear the undici alerts
ovr Sep 11, 2026
c3694a9
chore(testing): Drop the dead cypress-plugin-snapshots dependency
ovr Sep 11, 2026
589de9c
fix(backend-maven): Bump xmlbuilder2 to 4 to clear the js-yaml 3.x al…
ovr Sep 11, 2026
389f370
fix(playground): Bump js-cookie to 3
ovr Sep 11, 2026
927b8fe
fix(cubestore): Bump @octokit/core to 5
ovr Sep 11, 2026
f2636f1
chore(deps): Point dependabot at the manifests that actually carry al…
ovr Sep 11, 2026
fe2216e
Apply suggestion from @claude[bot]
ovr Sep 17, 2026
7f9a7eb
fix(deps): Re-resolve the root lockfile after the Angular 20 rebase
ovr Sep 18, 2026
bae720c
fix(deps): Bump body-parser to ^1.20.8 in api-gateway and server
ovr Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,11 @@
version: 2
updates:
- package-ecosystem: "npm"
directory: "/packages"
directories:

@claude claude Bot Sep 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Collapsing these into a single npm entry means one shared open-pull-requests-limit, which defaults to 5. The root / directory alone is the whole Yarn workspace tree (every packages/* manifest), so it will almost always have more than five eligible version updates queued — and Dependabot fills the limit per entry, not per directory. In practice /docs-mintlify, /packages/cubejs-playground/vizard, and vizard/apps/* will be starved indefinitely behind root's backlog.

(Security updates have their own separate limit, so alert-driven PRs still flow — but this config is also what drives regular version updates, and those are the ones that get squeezed.)

Two ways out:

  • Split into one entry per directory group, each with its own limit — most predictable, and lets you give the workspace root a higher ceiling than the smaller trees.
  • Keep one entry but raise open-pull-requests-limit well above 5 and add groups so the root workspace's updates batch into a few PRs instead of consuming slots one at a time.

Either way the limit needs to be stated explicitly; the default is the binding constraint here.

- "/"
- "/docs-mintlify"
- "/packages/cubejs-playground/vizard"
- "/packages/cubejs-playground/vizard/apps/*"
schedule:
interval: "weekly"
- package-ecosystem: "npm"
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@
},
"resolutions": {
"es5-ext": "0.10.53",
"lodash": "^4.17.0",
"lodash": "^4.18.0",
"@types/node": "^22",
"@types/ramda": "0.27.40",
"thrift": "0.20.0"
Expand Down
4 changes: 2 additions & 2 deletions packages/cubejs-api-gateway/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@
"@cubejs-backend/shared": "1.7.40",
"@ungap/structured-clone": "^0.3.4",
"assert-never": "^1.4.0",
"body-parser": "^1.19.0",
"body-parser": "^1.20.8",
Comment thread
ovr marked this conversation as resolved.
"chrono-node": "2.6.2",
"express": "^4.21.1",
"express": "^4.22.2",
Comment thread
claude[bot] marked this conversation as resolved.
"express-graphql": "^0.12.0",
"graphql": "^15.8.0",
"graphql-scalars": "^1.10.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-backend-maven/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
"dependencies": {
"@cubejs-backend/shared": "1.7.40",
"source-map-support": "^0.5.19",
"xmlbuilder2": "^2.4.0"
"xmlbuilder2": "^4.0.3"

@claude claude Bot Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

xmlbuilder2 jumps two majors (2 → 4) and nothing in CI exercises the result. The only guard is the exact-string fixture assertion in packages/cubejs-backend-maven/test/maven.test.ts:11, which compares generateXml() byte-for-byte against test/fixtures/generate-xml-1.xml — including the <?xml version="1.0"?> declaration and the two-space prettyPrint indentation that end({ prettyPrint: true }) emits. Both are defaults that a major bump is entitled to change.

That assertion is unreachable from CI: the only test script here is "unit:disabled-for-ci": "jest dist/test/*.js" (packages/cubejs-backend-maven/package.json:24), disabled because the second test in the same file (resolveDependencies, line 29) actually shells out to Maven and downloads hive-jdbc from Maven Central.

Splitting the network test out would make the bump verifiable:

    "unit": "jest dist/test/maven.test.js -t generateXml",
    "unit:disabled-for-ci": "jest dist/test/*.js"

generateXml is pure — no Maven, no network — so a -t generateXml run is CI-safe. Without it, a format change in xmlbuilder2 4 ships silently; Maven itself tolerates reformatted POMs, so the failure mode is a fixture that quietly drifts out of sync rather than a broken build.

},
"devDependencies": {
"@cubejs-backend/linter": "1.7.40",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-crate-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
"@cubejs-backend/testing-shared": "1.7.40",
"@types/jest": "^29",
"@types/node": "^22",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"publishConfig": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-druid-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
"@types/jest": "^29",
"@types/node": "^22",
"jest": "^29",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"publishConfig": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-mongobi-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
"devDependencies": {
"@cubejs-backend/linter": "1.7.40",
"@types/jest": "^29",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"jest": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-mysql-aurora-serverless-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
"@cubejs-backend/linter": "1.7.40",
"@types/jest": "^29",
"jest": "^29",
"testcontainers": "^10.28.0"
"testcontainers": "^12.1.0"
},
"license": "Apache-2.0",
"publishConfig": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-mysql-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@
"@types/node": "^22",
"jest": "^29",
"stream-to-array": "^2.3.0",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"license": "Apache-2.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-pinot-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"@types/node": "^22",
"jest": "^29",
"should": "^13.2.3",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",

@claude claude Bot Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The testcontainers 10 → 12 bump drops Compose v1 support, and none of the five Compose-based driver suites are in the verified list.

Evidence in the lockfile: the compose wrapper went docker-compose@^0.24.8 → docker-compose@^1.4.2 (yarn.lock:11071), whose 1.x default is the docker compose v2 plugin rather than the standalone docker-compose v1 binary. Every DockerComposeEnvironment call site therefore now requires the v2 plugin on the host:

  • packages/cubejs-pinot-driver/test/Pinot.test.ts:43
  • packages/cubejs-mongobi-driver/test/MongoBiDriver.test.ts:15
  • packages/cubejs-trino-driver/test/integration/trino-driver.test.ts:39
  • packages/cubejs-prestodb-driver/test/integration/presto-driver.test.ts:39
  • packages/cubejs-druid-driver/test/druid-driver.test.ts:33

The PR's Docker-backed runs cover postgres-driver, mysql-driver, cubestore and mysql-aurora-serverless-driver — all GenericContainer paths, none of them Compose. yarn tsc proves the Compose types still line up but says nothing about the runtime, and the failure mode is a host-level "compose not found" that only appears where these suites actually run. Worth running one of them (druid is the cheapest) before merge, or confirming the runner image ships the v2 plugin.

"typescript": "~6.0.3"
}
}
2 changes: 1 addition & 1 deletion packages/cubejs-playground/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
"graphql-ws": "^5.7.0",
"history": "^4.9.0",
"html-entities": "^2.3.3",
"js-cookie": "^2.2.1",
"js-cookie": "^3.0.7",
"js-object-pretty-print": "^0.3.0",
"js-yaml": "^4.1.0",
"jwt-decode": "^3.1.2",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-postgres-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@
"@cubejs-backend/testing-shared": "1.7.40",
"@types/jest": "^29",
"@types/node": "^22",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"publishConfig": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-prestodb-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"@types/node": "^22",
"jest": "^29",
"should": "^13.2.3",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
}
}
2 changes: 1 addition & 1 deletion packages/cubejs-questdb-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@
"@cubejs-backend/testing-shared": "1.7.40",
"@types/jest": "^29",
"@types/node": "^22",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"publishConfig": {
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-schema-compiler/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@
"pg-promise": "^11.5.5",
"source-map-support": "^0.5.19",
"sqlstring": "^2.3.3",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
},
"license": "Apache-2.0"
Expand Down
4 changes: 2 additions & 2 deletions packages/cubejs-server/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,10 +49,10 @@
"@oclif/errors": "^1.3.4",
"@oclif/plugin-help": "^3.2.0",
"@yarnpkg/lockfile": "^1.1.0",
"body-parser": "^1.19.0",
"body-parser": "^1.20.8",
"codesandbox-import-utils": "^2.1.12",
"cors": "^2.8.4",
"express": "^4.21.1",
"express": "^4.22.2",
"jsonwebtoken": "^9.0.2",
"semver": "^7.6.3",
"source-map-support": "^0.5.19",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-testing-drivers/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@
"jest": "^29",
"jsonwebtoken": "^9.0.2",
"pg": "^8.18.0",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3",
"yaml": "^2.7.1",
"yargs": "^17.7.1"
Expand Down
4 changes: 2 additions & 2 deletions packages/cubejs-testing-shared/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,10 +27,10 @@
"@cubejs-backend/query-orchestrator": "1.7.40",
"@cubejs-backend/schema-compiler": "1.7.40",
"@cubejs-backend/shared": "1.7.40",
"@testcontainers/kafka": "~10.28.0",
"@testcontainers/kafka": "~12.1.0",
"dedent": "^0.7.0",
"node-fetch": "^2.7.0",
"testcontainers": "^10.28.0"
"testcontainers": "^12.1.0"

@claude claude Bot Sep 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

engines.node at packages/cubejs-testing-shared/package.json:15 is >=20.0.0, but testcontainers is a published runtime dependency here (not a devDependency as in every other package in this PR), and testcontainers@12.1.0 pulls undici@^8.9.0 — yarn.lock:18949. undici 8 requires node >= 20.18.1, so installing @cubejs-backend/testing-shared on Node 20.0.0–20.18.0 now produces an EBADENGINE warning that the declared range says shouldn't happen.

Raising the floor to >=20.18.1 makes the manifest match what the dependency graph actually needs. Worth checking testcontainers@12's own engines too while you're in there — if it is >=22, the floor needs to go further.

},
"devDependencies": {
"@cubejs-backend/linter": "1.7.40",
Expand Down
1 change: 0 additions & 1 deletion packages/cubejs-testing/cypress/plugins/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@
// This function is called when a project is opened or re-opened (e.g. due to
// the project's config changing)

// const { initPlugin } = require('cypress-plugin-snapshots/plugin');
const { addMatchImageSnapshotPlugin } = require('@simonsmith/cypress-image-snapshot/plugin');

/**
Expand Down
3 changes: 0 additions & 3 deletions packages/cubejs-testing/cypress/support/e2e.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,6 @@
// https://on.cypress.io/configuration
// ***********************************************************

// Import commands.js using ES2015 syntax:
// import 'cypress-plugin-snapshots/commands';

import 'cypress-localstorage-commands';
import '@4tw/cypress-drag-drop';
import { addMatchImageSnapshotCommand } from '@simonsmith/cypress-image-snapshot/command';
Expand Down
3 changes: 1 addition & 2 deletions packages/cubejs-testing/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@
"http-proxy": "^1.18.1",
"node-fetch": "^2.7.0",
"ramda": "^0.27.2",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"yargs": "^17.7.1"
},
"devDependencies": {
Expand All @@ -119,7 +119,6 @@
"@types/node": "^22",
"cypress": "15.21.1",
"cypress-localstorage-commands": "^1.4.5",
"cypress-plugin-snapshots": "^1.4.4",
"cypress-wait-until": "^1.7.2",
"globby": "^11.0.4",
"jest": "^29",
Expand Down
2 changes: 1 addition & 1 deletion packages/cubejs-trino-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"@types/jest": "^29",
"@types/node": "^22",
"jest": "^29",
"testcontainers": "^10.28.0",
"testcontainers": "^12.1.0",
"typescript": "~6.0.3"
}
}
2 changes: 1 addition & 1 deletion packages/cubejs-vertica-driver/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
"@cubejs-backend/testing-shared": "1.7.40",
"@types/jest": "^29",
"jest": "^29",
"testcontainers": "^10.28.0"
"testcontainers": "^12.1.0"
},
"publishConfig": {
"access": "public"
Expand Down
2 changes: 1 addition & 1 deletion rust/cubestore/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@
},
"dependencies": {
"@cubejs-backend/shared": "1.7.40",
"@octokit/core": "^3.2.5",
"@octokit/core": "^5.2.2",

@claude claude Bot Sep 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@octokit/core 3 → 5 silently drops proxy support for the release lookup.

js-wrapper/src/download.ts:19-24 passes request.agent = await getHttpAgentForProxySettings(), which is a proxy-agent http.Agent.

  • On master, @octokit/core@3 → @octokit/request@5.6.3, which depends on node-fetch@^2.6.7 and forwards agent — so HTTP_PROXY/HTTPS_PROXY was honored.
  • With @octokit/core@5.2.2 → @octokit/request@8.4.1 (no node-fetch/undici dep — it uses global fetch), the agent option is no longer forwarded; native fetch ignores it.

@octokit/types still declares agent?: unknown on RequestRequestOptions, so this compiles and typechecks and fails only at runtime, for users behind a proxy, on the 404 fallback path that resolves release metadata. The primary downloadAndExtractFile path is unaffected, which makes it easy to miss.

Fix direction: pass a custom request.fetch that applies an undici ProxyAgent as dispatcher (add a helper alongside getHttpAgentForProxySettings), or leave @octokit/core on 3 in this commit if the fetch-based proxy plumbing is out of scope for a dependency PR.

Also engines (line 7-9) still claims ^12.0.0 || ^14.0.0 || >=16.0.0; @octokit/core@5 requires Node ≥ 18. Worth aligning with the >=20.0.0 the other packages declare.

@claude claude Bot Sep 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-checked on the current head: still live. rust/cubestore/package.json:45 is still "@octokit/core": "^5", and js-wrapper/src/download.ts:23 still passes request: { agent: await getHttpAgentForProxySettings() }, which @octokit/request@8's native-fetch transport ignores. Leaving open.

"source-map-support": "^0.5.19"
},
"jest": {
Expand Down
Loading
Loading