Skip to content

chore: bring dependencies and CI up to date (24.4) - #25678

Open
totally-not-ai[bot] wants to merge 8 commits into
24.4from
chore/update-dependencies-24.4
Open

chore: bring dependencies and CI up to date (24.4)#25678
totally-not-ai[bot] wants to merge 8 commits into
24.4from
chore/update-dependencies-24.4

Conversation

@totally-not-ai

Copy link
Copy Markdown
Contributor

Related to #25675

build failure · whole build · anyone building or releasing 24.4

The branch has not been touched since January and no longer builds: the
dev-server bundle is compiled with whatever TypeScript npm resolves, and
TypeScript 7 removed the API the Rollup plugin calls. Libraries, build
plugins and frontend packages are further behind than on any other
maintained branch, so this brings them as close to 24.10 as possible
without crossing a major, and makes the validation workflow runnable
again.

Risks:

  • ⚠️ Behaviour change: applications get newer frontend packages (Vite
    5.4.21, Lit 3.3.3, Polymer 3.5.2, react-router-dom 6.30.6, TypeScript
    5.9.3) and Flow now installs Node v20.20.2 and pnpm 8.15.9 by default.
  • ⚠️ Public API: DevToolsWrapper.close() added in flow-test-util.
  • 🔒 Security: Jackson, jsoup, Guava, slf4j and Hibernate Validator move
    to their current patch releases. Spring Boot stays on 3.2.12, the last
    release of the line this branch ships with.
  • ❓ Open question: the integration tests have not been run here, because
    they need the TestBench license. CI has to confirm them.
  • ✅ No signature removals, no serialization, threading or memory changes.

Context. 24.4 is commercially supported again, so the branch has to
build and release. Its validation workflow started every job with a
write-access check that fails for bots and outside contributors, which is
why the breakage went unnoticed, and the jobs still ran on ubuntu-22.04
with Chrome installed from a floating action tag.

  • Pinned typescript to ^5.9.3 in vaadin-dev-server, the same fix
    24.10 got in build(vaadin-dev-server): align TypeScript version (24.10) #24959, which is what makes the build pass again.
  • Updated libraries and build plugins to their latest patch releases:
    Jackson 2.21.5, jsoup 1.23.1, Guava 33.7.1, slf4j 2.0.17, Hibernate
    Validator 8.0.2, Jetty 12.0.27, TestBench 9.6.3, Surefire/Failsafe
    3.5.3, Clean 3.4.1, Build Helper 3.6.0, Maven API 3.9.9.
  • Pinned maven-install-plugin to 3.1.4, as on 24.10, so parallel installs
    cannot corrupt local repository metadata.
  • Updated the frontend dependency manifests with
    scripts/update-frontend-dependencies.sh, which caps every non-main
    branch at minor releases, and raised the default Node and pnpm versions.
  • Replaced the generated Selenium CDP classes in DevToolsWrapper with
    hand-built Network and Target commands, as 24.10 does, which also
    lets the PWA test drop its pinned selenium-devtools-v123 dependency.
  • Refreshed the validation workflow: dropped the write-access gate and the
    archived stCarolas/setup-maven, moved the jobs to ubuntu-24.04 with the
    browser the runner image ships, guarded the TestBench license check for
    fork pull requests, pinned every action to a commit, and listed the
    branches that are maintained today.
  • Adjusted the NodeUpdaterTest Polymer and glob expectations to the
    versions the frontend manifest now pins.

Left out on purpose, because they cross a major: Atmosphere client 3.1.3
to 4.0.1, bnd 6.4.0 to 7.1.0, glob to 12, and Vite to 7.

@rollup/plugin-typescript resolves its TypeScript peer dependency freely,
so the dev-server bundle now builds against TypeScript 7, where
ts.ScriptTarget.ES2015 no longer exists and the vite build fails with
"Cannot read properties of undefined (reading 'ES2015')". Pinning the
same 5.x range the other branches use keeps the build working.
The branch had not been updated since January, so libraries, build
plugins and frontend packages are behind the versions 24.10 ships.
Everything stays within its current major, which leaves Spring Boot on
3.2.12, the last release of the line the branch shipped with.
Builds were only allowed for actors with write access, which fails for
bots and outside contributors and left the branch without a way to run
CI at all. The jobs also ran on ubuntu-22.04 and installed Chrome from a
floating action, where the newer branches use the browser the runner
image ships.

Also brings in the frontend dependency update script so the branch can
be added to the weekly update workflow.
TestBench 9.6.3 ships a Selenium whose generated CDP package no longer
matches the v128 classes this used, and the generated classes only work
for the Chrome versions a Selenium release happens to bundle. Building
the few Network and Target commands by hand, as 24.10 does, keeps the
offline and cache tests working with any Chrome, and lets the PWA test
drop its pinned selenium-devtools-v123 dependency.
The default dev dependency tests state the Polymer and glob versions the
frontend manifest pins.
@totally-not-ai

Copy link
Copy Markdown
Contributor Author

Type of change

  • Internal change

How to test

  1. ./scripts/computeMatrix.js set-version --version=999.99-SNAPSHOT
  2. mvn install -B -ntp -DskipTests -pl '!flow-plugins/flow-gradle-plugin' — fails on this branch's base in the vaadin-dev-server npm build with TypeError: Cannot read properties of undefined (reading 'ES2015'), passes with this branch.
  3. mvn verify -B -ntp -fae -Dmaven.javadoc.skip=false for the unit test modules — all 23 modules pass.

Verified locally on JDK 17 with the same commands CI runs: full install
build green, and the unit test modules from both CI shards green (3754
tests in flow-server, no failures). The integration tests were not
run locally — they need the TestBench license, so the offline/cache tests
that use the rewritten DevToolsWrapper are only covered once CI runs
them here.

API changes

Compared to origin/24.4:

  • Added public void DevToolsWrapper.close() (flow-test-util)
  • FrontendTools.DEFAULT_NODE_VERSION value v20.15.0v20.20.2
  • FrontendTools.DEFAULT_PNPM_VERSION value 8.6.118.15.9

No removals or signature changes.

Why the build broke by itself

@rollup/plugin-typescript declares TypeScript as a peer dependency, and
vaadin-dev-server never pinned it, so every npm install picks the
newest release. TypeScript 7 dropped ts.ScriptTarget.ES2015, which the
plugin reads at load time, so the vite config fails to load. 24.10 hit the
same thing in July and pinned ^5.9.3 in #24959.

@github-actions

Copy link
Copy Markdown
Contributor

Test Results

  585 files   -   535    585 suites   - 535   11m 25s ⏱️ - 55m 10s
6 134 tests  - 1 003  6 058 ✅  -   987  18 💤  - 34  0 ❌ ±0  58 🔥 +18 
6 152 runs   - 1 342  6 069 ✅  - 1 318  20 💤  - 43  0 ❌ ±0  63 🔥 +19 

For more details on these errors, see this check.

Results for commit dbf9eff. ± Comparison against base commit 1cd39cc.

TestBench 9.5 and later need the license checker 2.x and 3.x APIs, which
are a major step from the 1.x this branch ships, so the integration tests
fail to initialise. 9.4.5 is the newest release that still runs against
the 1.x checker, and it needs 1.13.5 rather than 1.12.14.
The Selenium that TestBench 9.4.5 brings has no overload taking a client
configuration.
The annotations came in transitively through TestBench 9.3, which the
9.4 line no longer does, so the tests using @NotThreadSafe stopped
compiling. 24.7 and 24.10 declare the dependency for the same reason.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant