Skip to content

Upgrade Vega to 5.33.1 - #2743

Merged
Flix6x merged 17 commits into
mainfrom
ui-bump-vega
Oct 19, 2026
Merged

Flix6x merged 17 commits into
mainfrom
ui-bump-vega

Conversation

@Flix6x

@Flix6x Flix6x commented Oct 19, 2026

Copy link
Copy Markdown
Member

Description

Stacked on #2711: its base branch, feat/vendor-ui-assets, mirrors #2711's head, so this diff only shows the upgrade.

  • Upgrade Vega from 5.22.1 to 5.33.1, the latest 5.x release, which addresses the known advisories against 5.22.1 (see Track updates and advisories for the UI's frontend libraries #2725). Vega-Lite (5.5.0) and Vega-Embed (6.21.0) stay as they are.
  • The npm package of Vega 5.33.1 has no licence file, so the manifest takes it from the v5.33.1 tag of the Vega repository.
  • The tutorial on building UIs now loads the same Vega version.
  • Added changelog item in documentation/changelog.rst

I compared an asset's graphs page and a sensor page on 5.22.1 and 5.33.1 in a headless browser: the charts are pixel-identical, tooltips and re-rendering after a date range change work the same, and no new console errors appear.

How to test

python -m flexmeasures.ui.utils.fetch_vendor_assets vega, then open an asset's graphs page and a sensor page, with fast charts turned off.

Related Items

#2711, #2725

🤖 Generated with Claude Code

https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1

TeaDrinkingProgrammer and others added 11 commits October 15, 2026 17:25
Loading them from CDNs breaks the UI on poor or no internet connections. FlexMeasures moved to CDNs in #21 as a small speed tweak, to be revisited if CDNs ever failed.

BREAKING CHANGE: FLEXMEASURES_JS_VERSIONS no longer has a default and is ignored, so plugins must read the js_versions template variable or flexmeasures.ui.utils.vendor_versions.JS_VERSIONS instead.

Refs #18

Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>
Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>
Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
…ir licences

The icons have no fixed release to fetch from, as Iconify renders them on request, so they stay committed under static/icons/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
…their files and hashes

Instead of committing ~5 MB of third-party files, record each library's version, files and SHA-256 hashes in flexmeasures/ui/utils/vendor_assets.py.
Running python -m flexmeasures.ui.utils.fetch_vendor_assets downloads them, with their licences, and checks each file against its hash.
Fetched files are served by FlexMeasures, and files that were not fetched load from their CDN, with the recorded hash as the tag's integrity attribute.
Fonts and images which flexmeasures.css referred to move into the vendor.html macros, since a static stylesheet cannot tell whether they were fetched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
… them

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
… on one line

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
@read-the-docs-community

read-the-docs-community Bot commented Oct 19, 2026 •

Copy link
Copy Markdown

Flix6x and others added 5 commits October 19, 2026 10:07
…ource copy in the Docker build

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
…rsions of the UI's libraries, optionally with the hashes of their files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>

# Conflicts:
#	documentation/changelog.rst
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1
Signed-off-by: F.N. Claessen <felix@seita.nl>
@Flix6x
Flix6x changed the base branch from feat/vendor-ui-assets to main October 19, 2026 13:54
@Flix6x Flix6x added the dependencies Pull requests that update a dependency file label Oct 19, 2026
@Flix6x Flix6x self-assigned this Oct 19, 2026
@Flix6x Flix6x added this to the 1.1.0 milestone Oct 19, 2026
@Flix6x
Flix6x merged commit 05e9fc0 into main Oct 19, 2026
12 of 13 checks passed
@Flix6x
Flix6x deleted the ui-bump-vega branch October 19, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants