Check the UI's third-party libraries for advisories every week by Flix6x · Pull Request #2745 · FlexMeasures/flexmeasures

Flix6x · 2026-10-19T07:53:27Z

Description

Closes #2725. Stacked on #2711: its base branch, feat/vendor-ui-assets, mirrors #2711's head, so this diff only shows the check.

Dependabot only reads uv.lock, so nothing tells us when one of the UI's third-party libraries has a security advisory. This PR adds a workflow that looks up each library from the manifest in flexmeasures/ui/utils/vendor_assets.py in the OSV database:

ci/check_ui_library_advisories.py queries OSV for each library's npm package and version, prints a table of advisories (also into the job summary), and exits with 1 if it finds any.
.github/workflows/ui-library-advisories.yml runs it every Monday, on demand, and on pull requests that change the libraries or the check.
VendorLibrary gets an npm_package field for libraries served from elsewhere, so DataTables is looked up as datatables.net. The Poppins font isn't on npm, so it isn't checked.
Advisories which don't apply can be ignored per package and version, each with its reason. Two are listed:
- Vega 5.33.1: OSV lists one advisory against all of Vega below 6.2.0, but the advisory itself names vega-expression 5.2.1 as the fix outside ESM, and Vega 5.33.1 depends on that.
- ECharts 5.6.0: the advisory only concerns the tooltip of the lines series type, which we don't use (fast-chart.js draws line and bar series). So I didn't open an ECharts 6 upgrade, which would change the default theme and layout for no gain here.
Tests for reading the manifest without importing FlexMeasures, the npm names, and the ignore list. Each fails when the behaviour it covers is broken.

This check fails until the Vega and DataTables upgrades are merged. Those are #2743 and #2744, so it's best to merge them first.

A scheduled workflow that fails notifies the person who last changed its schedule. If we'd rather have it open an issue, that's a small change.

How to test

python ci/check_ui_library_advisories.py, with Flask installed.
pytest flexmeasures/ui/tests/test_ui_library_advisories.py

Related Items

#2725, #2718, #2711

🤖 Generated with Claude Code

https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1

Loading them from CDNs breaks the UI on poor or no internet connections. FlexMeasures moved to CDNs in #21 as a small speed tweak, to be revisited if CDNs ever failed. BREAKING CHANGE: FLEXMEASURES_JS_VERSIONS no longer has a default and is ignored, so plugins must read the js_versions template variable or flexmeasures.ui.utils.vendor_versions.JS_VERSIONS instead. Refs #18 Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>

Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

…ir licences The icons have no fixed release to fetch from, as Iconify renders them on request, so they stay committed under static/icons/. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

…their files and hashes Instead of committing ~5 MB of third-party files, record each library's version, files and SHA-256 hashes in flexmeasures/ui/utils/vendor_assets.py. Running python -m flexmeasures.ui.utils.fetch_vendor_assets downloads them, with their licences, and checks each file against its hash. Fetched files are served by FlexMeasures, and files that were not fetched load from their CDN, with the recorded hash as the tag's integrity attribute. Fonts and images which flexmeasures.css referred to move into the vendor.html macros, since a static stylesheet cannot tell whether they were fetched. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

… them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Dependabot only reads uv.lock, so it does not know about the UI's third-party libraries. A scheduled workflow now looks up each library's npm package and version in the OSV database, and fails when one has an advisory, listing them in the job summary. It also runs on pull requests that change the libraries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

…exMeasures does not use Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

… on one line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

read-the-docs-community · 2026-10-19T08:07:02Z

Documentation build overview

📚 flexmeasures | 🛠️ Build #35244153 | 📁 Comparing 8fa5e81 against latest (0144f89)

🔍 Preview build

11 files changed · + 2 added · ± 9 modified

+ Added

± Modified

…ource copy in the Docker build Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

…rsions of the UI's libraries, optionally with the hashes of their files Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl> # Conflicts: # flexmeasures/ui/utils/vendor_assets.py

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Flix6x

Tested manually, too.

…2746) The background fetch's lock test now also counts the fake library's notice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

TeaDrinkingProgrammer and others added 12 commits October 15, 2026 17:25

feat: serve asset type icons locally

9d93a2c

Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>

docs: link PR #2711 in the changelog entry

783093d

Signed-off-by: Stijn van Houwelingen <teadrinkingprogrammer@proton.me>

Merge main into feat/vendor-ui-assets

45fdb7d

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Fetch the UI's libraries into the Docker image, and check that it has…

e48d6ce

… them Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Document how to serve the UI's libraries without internet access

af1d2be

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Ignore the ECharts advisory, which only affects a series type that Fl…

8900b5c

…exMeasures does not use Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Put the comment on VendorLibrary.name above it, where black leaves it…

6cfa981

… on one line Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Merge feat/vendor-ui-assets (#2711) into ui-library-advisories

3653174

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Flix6x mentioned this pull request Oct 19, 2026

Serve UI assets from FlexMeasures instead of CDNs #2711

Merged

6 of 8 tasks

Flix6x and others added 5 commits October 19, 2026 10:07

Fetch the UI's libraries into the installed package rather than the s…

57e6794

…ource copy in the Docker build Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Merge feat/vendor-ui-assets (#2711)

e19ea75

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Merge feat/vendor-ui-assets (#2711)

8184dd3

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl> # Conflicts: # flexmeasures/ui/utils/vendor_assets.py

Merge main, now that #2711 was squash-merged

1338cd4

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Flix6x changed the base branch from feat/vendor-ui-assets to main October 19, 2026 13:54

Flix6x self-assigned this Oct 19, 2026

Merge main, now that the Vega and DataTables upgrades were merged

8fa5e81

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019bawYg67N5T5csiFdwWgZ1 Signed-off-by: F.N. Claessen <felix@seita.nl>

Flix6x added security dependency-hygiene UI labels Oct 19, 2026

Flix6x commented Oct 19, 2026

View reviewed changes

Flix6x merged commit 5665664 into main Oct 19, 2026
14 checks passed

Flix6x deleted the ui-library-advisories branch October 19, 2026 14:35

nhoening added this to the 1.1.0 milestone Oct 28, 2026

Navigation Menu

Repository navigation

Check the UI's third-party libraries for advisories every week - #2745

Check the UI's third-party libraries for advisories every week#2745
Flix6x merged 18 commits into
mainfrom
ui-library-advisories

Flix6x commented Oct 19, 2026

Uh oh!

read-the-docs-community Bot commented Oct 19, 2026 •

edited

Loading

Uh oh!

Flix6x left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Flix6x commented Oct 19, 2026

Description

How to test

Related Items

Uh oh!

read-the-docs-community Bot commented Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Documentation build overview

Uh oh!

Flix6x left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

read-the-docs-community Bot commented Oct 19, 2026 •

edited

Loading