Regular update for Dependencies

cris-oddball commented 1 year ago

User Story - Business Need

We wish to keep dependencies up to date so we do not need such massive overhauls of our system. This will be a recurring ticket that will be done every sprint. We will update all dependencies we are able to. Any conflicts will get a ticket. This is intended to be a day of work at most because this is intended to update with only non-breaking changes.

[x] Ticket is understood and QA has been contacted

User Story

As VA Notify I want to keep our service up to date So that we are secure and as free of bugs as possible

Additional Info and Resources

Relevant section of README.md

Engineering Checklist

[x] Update performed
[x] Dependabot issues updated
[x] Any conflicts removed and tickets created
[x] Passes all tests locally
[x] Passes userflows and QA Suite testing against Dev
[x] Any major changes are investigated (compare existing to new version changes)
- [ ] Any questionable version changes are removed and a ticket is created
[ ] Tickets created are added to the Epic for tracking purposes

Acceptance Criteria

Repo dependencies are updated and we have no broken functionality. Issues opened by Dependabot are resolved. Tickets created for any updates we could, or should, not do.

QA Considerations

[x] Check to see if these updates cancel out any Twistlock issues
[x] QA Regression tests pass after deploying this code.

mjones-oddball commented 1 year ago

This is at risk because QA cutoff is Thursday at 2 pm ET. If no one can pick this up tomorrow and let us know the scope to confirm it's possible by then we will need to pull it from the sprint. CC @tabinda-syed

babyjunior56 commented 1 year ago

Created ticket #1380 to address conflict that occurred with PyJWT>=2.8.0

babyjunior56 commented 1 year ago

Results of regular upgrade

babyjunior56 commented 1 year ago

This particular dependabot fixed: https://github.com/department-of-veterans-affairs/notification-api/security/dependabot/33

cris-oddball commented 1 year ago

No new Twistlock issues resolved. In fact, one new one found for pypdf2, which will be cleared when the two tickets to change to pypdf are worked.

cris-oddball commented 1 year ago

PERF: 130 passed, 2 skipped, 3 xfailed in 119.36s (0:01:59)

Leaving open until tomorrow morning to ensure that BigQuery still has data.

cris-oddball commented 1 year ago

BQ data exists for the previous day; closing ticket.

cris-oddball commented 1 year ago

whoops, cannot close this ticket - I just deployed the perf branch, this code has not yet been merged to master.

cris-oddball commented 1 year ago

Closing - this did get merged yesterday!

department-of-veterans-affairs / notification-api