Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update @svgr/webpack to version 6 #5958

Merged
merged 6 commits into from Nov 29, 2021
Merged

Conversation

ludofischer
Copy link
Contributor

Motivation

Have you read the Contributing Guidelines on pull requests?

Yes

Test Plan

Existing tests since behaviour should stay the same.

Related PRs

#5703

* svgr changelog https://github.com/gregberge/svgr/releases
* SVGO 2 changelog https://github.com/svg/svgo/releases/tag/v2.0.0
* depend on maintained svgo version
* although svgr 6 is in alpha, it fixes a few issues
  with webpack 5 (gregberge/svgr@1a8cc98)
  and React (gregberge/svgr@3700aba)
* see also facebook#5703
Copy link
Collaborator

@Josh-Cena Josh-Cena left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, fixed the webpack config breaking changes

I honestly don't know what the state of #5703 is and whether we plan to upgrade SVGR in that PR instead... I also don't know if it's good to send an Alpha version down to all the users because we put it in the init template, but overall after #5872 I think we feel a much stronger compelling force to upgrade.

@netlify
Copy link

netlify bot commented Nov 17, 2021

✔️ [V2]
Built without sensitive environment variables

🔨 Explore the source changes: df034ca

🔍 Inspect the deploy log: https://app.netlify.com/sites/docusaurus-2/deploys/61a45cdd61a6850008b6f026

😎 Browse the preview: https://deploy-preview-5958--docusaurus-2.netlify.app

@github-actions
Copy link

github-actions bot commented Nov 17, 2021

⚡️ Lighthouse report for the changes in this PR:

Category Score
🟢 Performance 92
🟢 Accessibility 98
🟢 Best practices 100
🟢 SEO 100
🟢 PWA 95

Lighthouse ran on https://deploy-preview-5958--docusaurus-2.netlify.app/

@Josh-Cena
Copy link
Collaborator

For some reason E2E tests are failing because it's still trying to pull the old SVGR v5 ㄟ(▔,▔)ㄏ

@Josh-Cena Josh-Cena added the pr: maintenance This PR does not produce any behavior differences to end users when upgrading. label Nov 17, 2021
@slorber
Copy link
Collaborator

slorber commented Nov 17, 2021

What are good reasons to ship an alpha?

What is the benefit for the Docusaurus users in particular?

@ludofischer
Copy link
Contributor Author

ludofischer commented Nov 17, 2021

For some reason E2E tests are failing because it's still trying to pull the old SVGR v5 ㄟ(▔,▔)ㄏ

From what I can see, Yarn 1 on Node.js 17 fails, Yarn 1 on Node.js 16 fails but Yarn berry on Node.js 14 succeeds and Yarn 1 on Node.js 14 succeeds. Why do you think the cause is that it is still trying to pull SVGR 5? I do notice that if you run yarn examples:generate, the generated examples use @svgr/webpack: '6.0.0-alpha.4 do end up with two different major versions of @svg/webpack in yarn.lock. They seem to use the template from the repository but depend on the published Docusaurus version. If something similar happens when the integration tests run, that could explain conflicting dependencies. But I doubt the integration tests run on the published Docusaurus version, it would not make much of a test.

@slorber
Copy link
Collaborator

slorber commented Nov 17, 2021

But I doubt the integration tests run on the published Docusaurus version, it would not make much of a test.

We publish the docusaurs on a locally hosted Verdaccio npm repository, and then install the published version (not from global npm registry).

Not sure why it happens exactly but we must figure this out for sure.

We have a yarn test:build:website to test that locally (requires Docker to setup Verdaccio) if you want to take a look at it

@ludofischer
Copy link
Contributor Author

What are good reasons to ship an alpha?

What is the benefit for the Docusaurus users in particular?

As a user myself, I prefer to depend (transitively) on an updated svgo version. As many packages that deal with parsing and XML tend to be fairly security-alert prone. Of course, most of these alerts do not apply to the usage in Docusaurus, but it is a burden to always have to explain this. From looking at the issues in the svg repository I have the impression that svgr has few breaking changes (or changes at all) planned. We can ask @gregberge if using the alpha is recommended.

@gregberge
Copy link
Contributor

Yeah it is safe enough, I think I will release the final this weekend. The core is done, I just need to update docs.

@ludofischer
Copy link
Contributor Author

Yeah it is safe enough, I think I will release the final this weekend. The core is done, I just need to update docs.

Thanks for the heads up!

@ludofischer
Copy link
Contributor Author

ludofischer commented Nov 17, 2021

Not sure why it happens exactly but we must figure this out for sure.

I am not sure what you mean. From the log I think the CI is 's publishing the state of the checked-out repository to the Verdaccio instance as current-version.NEW. For example 2.0.0-beta.9.NEW. Then it installs the newly published version:

npm_config_registry="$CUSTOM_REGISTRY_URL" npm init docusaurus@"$NEW_VERSION" test-website classic $EXTRA_OPTS

We have a yarn test:build:website to test that locally (requires Docker to setup Verdaccio) if you want to take a look at it

When I have tried running yarn examples:generate the script tried to access my SSH private keys and assumed I was the user slorber ;-) I don't know if I will have the time to reproduce the build pipeline on my machine.

@Josh-Cena
Copy link
Collaborator

What are good reasons to ship an alpha?

There are multiple deprecation / security warnings for SVGR v5 -> SVGO v1. Also #5144. Also in the wake of #5872 we should think about using a more robust dep version.

I think I will release the final this weekend.

Cool, then let's wait till the weekend👍 Glad we don't have to ship alpha

When I have tried running yarn examples:generate the script tried to access my SSH private keys and assumed I was the user slorber ;-) I don't know if I will have the time to reproduce the build pipeline on my machine.

You don't need to run yarn examples:generate, just the e2e test workflow which runs admin/scripts/test-release.sh

@Josh-Cena
Copy link
Collaborator

Josh-Cena commented Nov 18, 2021

Fixed the E2E workflow. Also cleaned up the workflow a little bit

@Josh-Cena Josh-Cena added the status: don't merge yet This PR is completed, but we are still waiting for other things to be ready. label Nov 18, 2021
@slorber
Copy link
Collaborator

slorber commented Nov 18, 2021

Thanks @Josh-Cena that makes sense

Thanks @gregberge , I think we can wait for the final release then ;)

@gregberge
Copy link
Contributor

Thanks @Josh-Cena that makes sense

Thanks @gregberge , I think we can wait for the final release then ;)

Yeah I am sorry it takes time but it will happen!

@Josh-Cena
Copy link
Collaborator

@gregberge Thanks! Good job with the release. I've been following gregberge/svgr#629 as well. Happy to see v6 finally going stable

@Josh-Cena Josh-Cena removed the status: don't merge yet This PR is completed, but we are still waiting for other things to be ready. label Nov 29, 2021
@Josh-Cena Josh-Cena merged commit 5678911 into facebook:main Nov 29, 2021
@ludofischer ludofischer deleted the svgr-6 branch November 29, 2021 11:48
@slorber
Copy link
Collaborator

slorber commented Nov 30, 2021

👍

tnir added a commit to tnir/forem-docs that referenced this pull request May 2, 2022
with sole use of @svgr/webpack 6.2.1.

docusaurus v2.0.0-beta.10 upgraded @svgr/webpack to 6
facebook/docusaurus#5958

to partially address CVE-2021-3803 by removing nth-check 1.0.2
by removing css-select 2.1.0.

Signed-off-by: Takuya Noguchi <takninnovationresearch@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
CLA Signed Signed Facebook CLA pr: maintenance This PR does not produce any behavior differences to end users when upgrading.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants