dependabot updates for September

18F / tock

We use Tock to track and report our time at 18F

https://18f.gsa.gov/2015/05/21/TockingTime/

Other

120 stars 37 forks source link

dependabot updates for September #1796

Closed cantsin closed 2 weeks ago

cantsin commented 2 months ago

We have some fairly complicated library updates that need looking into:

djangorestframework update seems to break tests
websocket and puppeteer both need to be updated in tandem
certifi needs to be updated but dependabot can't seem to actually create a PR
And whatever else is in the "Security" -> "Dependabot alerts" section

nateborr commented 1 month ago

If at all possible I'd like to resolve our Tock monitoring issues in https://github.com/18F/tock/issues/1792 before applying these updates, so that we'll be able to detect errors and other unexpected behavior in production when we apply these library updates.

nateborr commented 1 month ago

I'll proceed with these updates. #1792 has been resolved, we have application monitoring for Tock again, and the batch of minor package updates since June 11 2024 has been deployed.

nateborr commented 1 month ago

I've run into multiple issues trying to apply the library updates piecemeal and discussed next steps with @neilmb :

We're currently using Pipenv for Python dependency management in Tock, but that tool does not readily allow you to update an individual package and its dependency tree, without resolving and applying all available updates to the package specifications in the project's Pipfile.
For this current set of updates, I'm going to do what the team has generally done in similar situations in the past, and attempt to apply all the package updates simultaneously.
@neilmb is opening a follow-up issue proposing that we migrate Tock to use Poetry for dependency management, and document that process.

nateborr commented 4 weeks ago

The Python library updates have been applied and released: https://github.com/18F/tock/releases/tag/v20241021.1

I'm still working on resolving issues with the Node library issues in https://github.com/18F/tock/pull/1819.

nateborr commented 3 weeks ago

https://github.com/18F/tock/pull/1819 to resolve the Node package update has been merged and looks healthy in staging so far. The primary change is to the automated testing that runs during our CircleCI build and deploy process and those jobs look healthy too. I'll kick the tires a little more and plan to release the change to production early next week.

I'll also capture a follow-up ticket to investigate stabilizing our browser-based integration testing, since the current Jest/Puppeteer based setup has some brittle elements. Once that's captured and the immediate changes are fully deployed, I'll mark this ticket as resolved.

nateborr commented 3 weeks ago

I've opened #1822 as a follow-up issue.

nateborr commented 2 weeks ago

This is fully deployed to production with https://github.com/18F/tock/releases/tag/v20241031.1 .