ui package upgrades by DaanHoogland · Pull Request #13632 · apache/cloudstack

DaanHoogland · 2026-07-16T14:10:54Z

Description

This PR...

Fixes: #13631

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

codecov · 2026-07-16T14:23:22Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 19.73%. Comparing base (8b72a16) to head (e51ab1f).

Additional details and impacted files

@@            Coverage Diff             @@
##               main   #13632    +/-   ##
==========================================
  Coverage     19.73%   19.73%            
- Complexity    19940    19942     +2     
==========================================
  Files          6371     6371            
  Lines        575734   575374   -360     
  Branches      70470    70470            
==========================================
- Hits         113594   113550    -44     
+ Misses       449793   449475   -318     
- Partials      12347    12349     +2

Flag	Coverage Δ
uitests	`3.32% <ø> (-0.09%)`	⬇️
unittests	`21.01% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-07-16T15:25:01Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	24.50%
Branch coverage	18.66%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

Fixes 17 CVEs in dompurify 3.2.6 including multiple XSS bypass vulnerabilities (GHSA-cjmm-f4jc-qw8r, GHSA-cmwh-pvxp-8882, et al.). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fixes GHSA-wc69-rhjr-hc9g in moment 2.29.3. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fixes GHSA-qjx8-664m-686j. Note: major version bump — js-cookie 3.x drops the global Cookies object; call sites using Cookies.get() etc. may need updating. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Fixes 21 CVEs in the abandoned axios 0.x branch including GHSA-898c-q2cr-xwhg (SSRF/header exposure). Note: major version bump — axios 1.x removes deprecated helpers and changes some error properties; review src/utils/request.js call sites. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

DaanHoogland · 2026-07-16T16:32:55Z

@blueorangutan ui

blueorangutan · 2026-07-16T16:34:04Z

@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

blueorangutan · 2026-07-16T16:56:03Z

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/13632 (QA-JID-961)

github-actions · 2026-07-16T17:22:46Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	24.50%
Branch coverage	18.66%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Upgrades fontawesome-svg-core, free-brands-svg-icons, free-solid-svg-icons to 6.7.2 and vue-fontawesome to 3.3.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

DaanHoogland · 2026-07-20T18:34:01Z

@blueorangutan ui

blueorangutan · 2026-07-20T18:35:04Z

@DaanHoogland a Jenkins job has been kicked to build UI QA env. I'll keep you posted as I make progress.

blueorangutan · 2026-07-20T18:56:25Z

UI build: ✔️
Live QA URL: https://qa.cloudstack.cloud/simulator/pr/13632 (QA-JID-967)

github-actions · 2026-07-20T19:33:45Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	24.50%
Branch coverage	18.66%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

npm run serve/start/build now set --openssl-legacy-provider automatically via node-options-wrapper.sh, only when the running Node actually needs it. The old manual instruction is not just redundant but actively harmful: a contributor who exports it persistently and later runs on Node 16 (what CI pins) crashes node outright, since that flag doesn't exist without OpenSSL 3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

+NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]")
+if [ "$NODE_MAJOR" -ge 17 ]; then
+  export NODE_OPTIONS="--openssl-legacy-provider ${NODE_OPTIONS}"
+fi


github-actions · 2026-07-21T09:31:00Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	24.50%
Branch coverage	18.66%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

Copilot

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

ui/node-options-wrapper.sh:26

The wrapper always injects --openssl-legacy-provider for Node >=17, but newer Node releases can reject this option in NODE_OPTIONS. If that happens, npm run serve/build will fail immediately even if the legacy provider workaround is no longer supported. Consider probing support before exporting the flag (and avoid integer-test errors if node isn't available).

NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]")
if [ "$NODE_MAJOR" -ge 17 ]; then
  export NODE_OPTIONS="--openssl-legacy-provider${NODE_OPTIONS:+ ${NODE_OPTIONS}}"
fi

DaanHoogland · 2026-08-11T13:40:45Z

 # Build example: docker build -t <name> .

-FROM node:14-bullseye AS build
+FROM node:24-bullseye AS build


@vishesh92 , I think this means we have the choice to

add the webpack upgrade in this PR, or

change the node version to 20 and upgrade it in a new PR
(maybe seeing more bears on the road than actually are there)

I ran npm run build on my local witrh node 24 and it ran sucessfuly.

nvazquez · 2026-08-12T10:24:02Z

Hi @DaanHoogland please advise when this PR is ready for testing

DaanHoogland · 2026-08-12T12:20:39Z

Hi @DaanHoogland please advise when this PR is ready for testing

yes @nvazquez , should be.

github-actions · 2026-08-21T09:46:35Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

sonarqubecloud · 2026-08-21T13:21:22Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2026-08-21T13:21:45Z

🔴 Test Coverage Grade: `D` — Marginal

Metric	Value
Line coverage	24.60%
Branch coverage	18.80%

Grade Scale

Grade	Line Coverage	Meaning
🟢 A	≥ 80%	Excellent - this code sleeps well at night 😴
🟡 B	60-79%	Good - almost there, don't stop now 😉
🟠 C	40-59%	Acceptable - your code is wearing a seatbelt, but no airbags 😬
🔴 D	20-39%	Marginal - boldly shipping where no test has gone before 🖖
⛔ F	< 20%	Failing - tests? what tests? 🔥

Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run

Copilot AI lite review requested due to automatic review settings July 16, 2026 14:10

boring-cyborg Bot added the component:UI label Jul 16, 2026

Copilot AI reviewed Jul 16, 2026

lodash upgrade

2356504

Copilot AI review requested due to automatic review settings July 16, 2026 14:13

DaanHoogland force-pushed the ghi13631-ui-package-upgrades branch from f22a38a to 2356504 Compare July 16, 2026 14:13

Copilot AI reviewed Jul 16, 2026

DaanHoogland added this to the 4.24.0 milestone Jul 16, 2026

Daan Hoogland and others added 5 commits July 16, 2026 18:15

ui: upgrade dompurify 3.2.6 -> 3.4.12

7272533

Fixes 17 CVEs in dompurify 3.2.6 including multiple XSS bypass vulnerabilities (GHSA-cjmm-f4jc-qw8r, GHSA-cmwh-pvxp-8882, et al.). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade moment 2.29.3 -> 2.30.1

257fb3a

Fixes GHSA-wc69-rhjr-hc9g in moment 2.29.3. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade vue-i18n 9.2.2 -> 9.14.5

32880fb

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade js-cookie 2.2.1 -> 3.0.8

e430b23

Fixes GHSA-qjx8-664m-686j. Note: major version bump — js-cookie 3.x drops the global Cookies object; call sites using Cookies.get() etc. may need updating. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings July 16, 2026 16:15

Copilot AI reviewed Jul 16, 2026

Daan Hoogland and others added 9 commits July 17, 2026 14:35

ui: upgrade @babel/core 7.18.6 -> 7.29.7

8d20c0c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade @FortAwesome packages 6.5.2 -> 6.7.2

126bc39

Upgrades fontawesome-svg-core, free-brands-svg-icons, free-solid-svg-icons to 6.7.2 and vue-fontawesome to 3.3.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade vue + @vue/compiler-sfc 3.2.37 -> 3.5.40

9704fe1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade @vue/test-utils 2.0.0 -> 2.4.11

c1ea9f9

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade babel-plugin-import 1.13.5 -> 1.13.8

9aa6bcc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade chartjs-adapter-moment 1.0.0 -> 1.0.1

da855ab

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade core-js 3.23.3 -> 3.49.0

6554c0c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade cronstrue 2.26.0 -> 2.59.0

55f4863

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui: upgrade eslint-plugin-import 2.26.0 -> 2.32.0

ee7ac56

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings July 21, 2026 08:24

Copilot started reviewing on behalf of DaanHoogland July 21, 2026 08:32 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread ui/node-options-wrapper.sh

Comment on lines +23 to +26

NODE_MAJOR=$(node -p "process.versions.node.split('.')[0]")

if [ "$NODE_MAJOR" -ge 17 ]; then

export NODE_OPTIONS="--openssl-legacy-provider ${NODE_OPTIONS}"

fi

Comment thread ui/package.json Outdated

Address comments

2fa8fd4

Copilot AI review requested due to automatic review settings August 11, 2026 11:49

boring-cyborg Bot added the docker label Aug 11, 2026

Copilot started reviewing on behalf of vishesh92 August 11, 2026 11:53 View session

DaanHoogland added the priority: high label Aug 11, 2026

DaanHoogland requested review from RosiKyu and nvazquez August 11, 2026 11:54

Copilot AI reviewed Aug 11, 2026

View reviewed changes

nvazquez added the status:ready-for-testing label Aug 12, 2026

github-actions Bot added the status:has-conflicts label Aug 21, 2026

Merge branch 'main' into ghi13631-ui-package-upgrades

e51ab1f

github-actions Bot removed the status:has-conflicts label Aug 21, 2026

apache deleted a comment from github-actions Bot Aug 23, 2026

DaanHoogland added this to CloudStack Testing Aug 31, 2026

github-project-automation Bot moved this to Backlog in CloudStack Testing Aug 31, 2026

DaanHoogland moved this from Backlog to Ready in CloudStack Testing Aug 31, 2026

Uh oh!

Conversation

DaanHoogland commented Jul 16, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Jul 16, 2026

🔴 Test Coverage Grade: D — Marginal

Grade Scale

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Jul 16, 2026

Uh oh!

blueorangutan commented Jul 16, 2026

Uh oh!

blueorangutan commented Jul 16, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

🔴 Test Coverage Grade: D — Marginal

Grade Scale

Uh oh!

DaanHoogland commented Jul 20, 2026

Uh oh!

blueorangutan commented Jul 20, 2026

Uh oh!

blueorangutan commented Jul 20, 2026

Uh oh!

github-actions Bot commented Jul 20, 2026

🔴 Test Coverage Grade: D — Marginal

Grade Scale

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

🔴 Test Coverage Grade: D — Marginal

Grade Scale

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

DaanHoogland Aug 11, 2026

Choose a reason for hiding this comment

Uh oh!

vishesh92 Aug 12, 2026

Choose a reason for hiding this comment

Uh oh!

nvazquez commented Aug 12, 2026

Uh oh!

DaanHoogland commented Aug 12, 2026

Uh oh!

github-actions Bot commented Aug 21, 2026

Uh oh!

sonarqubecloud Bot commented Aug 21, 2026

Quality Gate passed

Uh oh!

github-actions Bot commented Aug 21, 2026

🔴 Test Coverage Grade: D — Marginal

Grade Scale

codecov Bot commented Jul 16, 2026 •

edited

Loading

🔴 Test Coverage Grade: `D` — Marginal

🔴 Test Coverage Grade: `D` — Marginal

🔴 Test Coverage Grade: `D` — Marginal

🔴 Test Coverage Grade: `D` — Marginal

🔴 Test Coverage Grade: `D` — Marginal