finos / a11y-theme-builder

DesignOps toolchain theme builder for accessibility inclusion using Atomic Design.
Apache License 2.0
44 stars 69 forks source link

[TB] CVE scanning error reported #801

Closed aaronreed708 closed 7 months ago

aaronreed708 commented 8 months ago

Problem/Concern

It looks like the Docker build is failing due to an issue with MUI Select properties. I believe that this is similar to an issue that Bryce and I became aware of last week.

An example scanning error: https://github.com/finos/a11y-theme-builder/actions/runs/8176615961/job/22356443393

Showing the error:

#13 53.77   
#13 93.51 Failed to compile.
#13 93.51 
#13 93.51 TS2312: An interface can only extend an object type or intersection of object types with statically known members.
#13 93.51     2 | import { Select, SelectProps } from '@mui/material';
#13 93.51     3 |
#13 93.51   > 4 | interface Props extends SelectProps {
#13 93.51       |                         ^^^^^^^^^^^
#13 93.51     5 |     children?: ReactNode
#13 93.51     6 | }
#13 93.51     7 |
#13 93.51 
#13 93.51 

Proposed Solution

aaronreed708 commented 7 months ago

So the problem here is that when the GitHub actions were running (e.g. docker publishing and cve scanner) that built Theme Builder in a clean environment, they were pulling a later version of @mui/material than a developer who already has a version cached. More recent versions of @mui/material changed from exporting SelectProps to exporting BaseSelectProps. So any ThemeBuilder build using those versions of @mui/material were failing.

I fixed this by updating package.json to use the latest versions of mui and then changed Dropdown.tsx component to correctly use BaseSelectProps.

aaronreed708 commented 7 months ago

Verified building on dev with no errors in GitHub Actions for docker build. Closing.