As a developer, I want dependency updates #368
Comments
|
Feel free to edit the OP to replace |
|
I'm going to start on this today, but given this is a short day for me, I don't anticipate finishing it. In fact, if we start bumping to major versions, I may not even come close to finishing it today. To begin, my plan is to do a minor version bump. I'll then take a look at what major versions there are to consider and decide which if any to tackle with this update. Hank |
|
I've pulled the latest and am running unit tests on Hank |
|
I looked at the past dependency update to 6.27, #340, and searching a few libraries, it appears that, if a major version update is indicated by The results of Hank ========== |
|
Yeah, that is unfortunately a weakness of our dependency checker, it doesn't provide both the minor and major version options, so you do need to check for minor updates that are hidden by major ones, unfortunately. |
|
Or just do the major update, but I would take major updates carefully, one at a time. Our automated tests are probably good enough to catch most issues, once it is compiling (and major upgrades mean it may not compile, of course), but there is an extra risk, especially when working in the cowres components, tasker/worker/broker, as these are generally not very well covered by unit/integration tests. |
|
Adding #100 to the notable tickets in the description. Hank |
|
Thanks, James. I'll look into minor updates that are between the reported current and major. Hank |
|
I completed the (what I hope are) low hanging fruit minors upgrades. I'm unit testing now. If that completes successfully, I'll attempt to deploy to the -dev COWRES. I just need to see what the current process is deploy from the development area. Hank |
|
I've tackled all of the low-hanging fruit, minor version upgrades. That is, those identified by the dependency check. All pass unit tests except for this one:
I took the above to mean that I need to update the line, to reference 0.9.4. I made that change. When I did so, the build failed: When I backed that one up to 0.9.1, I was able to build the code and the unit tests passed. So, referring to the dependency check shared in my previous comment, I've handled all of the minor updates directly reported by dependency check, except for Hank P.S. Note to self so I don't lose it by the time I return to this ticket next week... When deploying the locally build .zips, the following command should work: ./scripts/dockerize.sh 20241126-b735d54-dev 20241113-6f1b17d-dev 20241113-6f1b17d-dev 20241126-b735d54-dev 20241126-b735d54-dev 20241126-b735d54-dev 20241126-2da40a3-dev 20241126-2da40a3-dev |
|
See #103. I had thought Evan addressed this recently, but I guess that was the protobuf dependencies themselves, not the gradle plugin. |
|
Thanks, James. I'll take a look. I was able to deploy what I have to -dev COWRES and get a smoke test to pass. Step 1 of many steps. :) Hank |
|
I read through #103. I also note #70. They appear to be related. I think what I'm seeing is that to update @com.google.protobuf@ to 0.9.4, we need the general protobuf dependencies to go to 4.26.1 or later. Is that right? If so, I can try that as my first major update when I get started on them. Thanks, Hank |
|
With the I do this so rarely that every time I update dependencies, I spend a lot of time reminding myself of the process. Hank |
Probably, but we'll see. According to the ticket by the people that maintain the gradle dep, it is fixed, so I would browse that ticket w/r to versions. I do recall that they hadn't backported the fix. |
|
Final update for today... I've updated the Dockerfiles; the Redhat UBI version changed to Once the minor changes are made, the next step will be to step through the major version updates one at a time and identify the ones that will cause problems for us. We'll then determine whether to work on each change soon/now, or push them off until later and find an interim minor version update (that is hidden by the major one pointed to by the dependency check). After a discussion with Josh Walston during "office hours", we decided that we should deploy next week. He's waiting on a couple of features that we will be deploying in 6.28. We'll have to decide if any of these dependency updates should go out in that deployment. If so, then I'll have to push what I can on Tuesday when I return to work. My day is done. Happy Thanksgiving! Hank |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Known Issues:
#68
#100
CVEs flagged by the github bot, which we can use alongside the gradle task,
dependencyCheckAnalyzehttps://github.com/NOAA-OWP/wres/security/dependabot
The text was updated successfully, but these errors were encountered: