search

uswds / uswds-site

USWDS website and documentation
https://designsystem.digital.gov
Other
189 stars 144 forks source link

USWDS-Site - POAM: May '24 #2673

Closed mahoneycm closed 3 months ago

mahoneycm commented 4 months ago

Summary

POAM updates for May 2024.

Breaking change

This is not a breaking change.

Related issue

Closes three dependabot alerts related to the Nokogiri gem

Preview link

Preview link →

Major changes

Testing and review

  1. Run npm install.
  2. Run npm run build and confirm there are no build errors.
  3. Run npm start and confirm there are no build errors.
  4. No perceived visual regressions.

Dependency updates

Dependency Previous version New version
axe-core 4.9.0 4.9.1
sass 1.74.1 ~1.77.0~ 1.77.2
snyk 1.1288.0 ~1.1291.0~ 1.1291.1

Ruby updates

Added sass-embedded to gemfile to resolve CI build errors.

mejiaj commented 4 months ago

@mahoneycm can you fix conflicts?

mahoneycm commented 4 months ago

Bundler Sass-embedded build error

Looking at the build error, we can see inconsistencies in which bundler version is being used:

  1. 2.2.0 - setup-bundler script starts by using the version listed in .bundler-version
  2. 2.3.7- When installing dependencies from the gemfile it uses a different version
  3. 2.3.17 - It then looks at the lockfile and see's it's generated with a another different version and tries to install and use it

It then runs into an issue not finding sass-embedded (1.77.0-x86_64-linux) from rubygems

Build log 
2024-05-20 17:43:14 INFO [setup-bundler] Using bundler version in .bundler-version
2024-05-20 17:43:17 INFO [setup-bundler] Successfully installed bundler-2.2.0
2024-05-20 17:43:17 INFO [setup-bundler] Parsing documentation for bundler-2.2.0
2024-05-20 17:43:17 INFO [setup-bundler] Installing ri documentation for bundler-2.2.0
2024-05-20 17:43:17 INFO [setup-bundler] Done installing documentation for bundler after 2 seconds
2024-05-20 17:43:17 INFO [setup-bundler] 1 gem installed
2024-05-20 17:43:17 INFO [setup-bundler] Gemfile.lock found. Attempting to download cache
2024-05-20 17:43:18 INFO [setup-bundler] No cache file found.
2024-05-20 17:43:18 INFO [setup-bundler] Installing dependencies in Gemfile
2024-05-20 17:43:18 INFO [setup-bundler] Bundler 2.3.7 is running, but your lockfile was generated with 2.3.17. Installing Bundler 2.3.17 and restarting using that version.
2024-05-20 17:43:18 INFO [setup-bundler] `` is not a directory.
2024-05-20 17:43:18 INFO [setup-bundler] Bundler will use `/tmp/bundler20240520-17396-qdxjlr17396' as your home directory temporarily.
2024-05-20 17:43:19 INFO [setup-bundler] Fetching gem metadata from https://rubygems.org/.
2024-05-20 17:43:19 INFO [setup-bundler] Fetching bundler 2.3.17
2024-05-20 17:43:19 INFO [setup-bundler] Installing bundler 2.3.17
2024-05-20 17:43:19 INFO [setup-bundler] `` is not a directory.
2024-05-20 17:43:19 INFO [setup-bundler] Bundler will use `/tmp/bundler20240520-17396-97eke517396' as your home directory temporarily.
2024-05-20 17:43:20 INFO [monitor] CPU Usage Percentage: 69.9
2024-05-20 17:43:20 INFO [monitor] Memory Usage Percentage: 28.2
2024-05-20 17:43:20 INFO [monitor] Disk usage: 3.2 GB / 5.8 GB
2024-05-20 17:43:21 INFO [setup-bundler] Fetching gem metadata from https://rubygems.org/.........
2024-05-20 17:43:21 INFO [setup-bundler] Your bundle is locked to sass-embedded (1.77.0-x86_64-linux) from rubygems
2024-05-20 17:43:21 INFO [setup-bundler] repository https://rubygems.org/ or installed locally, but that version can no
2024-05-20 17:43:21 INFO [setup-bundler] longer be found in that source. That means the author of sass-embedded
2024-05-20 17:43:21 INFO [setup-bundler] (1.77.0-x86_64-linux) has removed it. You'll need to update your bundle to a
2024-05-20 17:43:21 INFO [setup-bundler] version other than sass-embedded (1.77.0-x86_64-linux) that hasn't been removed
2024-05-20 17:43:21 INFO [setup-bundler] in order to install.
mahoneycm commented 4 months ago

Bundler version update

After updating the .bundler-version, installing gems using bundler 2.3.7, and rebuilding our Gemfile.lock, the build completes without error and consistently uses the same bundler version throughout the process.