[Dependencies] [Security] Upgrade to Gulp4 #6566

acconrad · 2018-09-05T20:13:09Z

This fixes multiple bugs (#6549 #5762 #6214 ) and implements #3793 by upgrading from Gulp 3.9.1 to 4.0.0 which was released a few months ago.

The primary goal of this is to incorporate a series of vulnerability fixes (minimatch, hoek, and lodash) that were introduced within the dependencies of gulp, and as a result were patched starting in Gulp v4.

The basic upgrade flow works like this:

Upgrade Gulp from 3.9.1 to 4.0.0
Upgrade gulp-help to the version that specifically supports Gulp4 (1.6.1 to chmontgomery/gulp-help#gulp4)
Upgrade additional dependencies that fix additional audit issues (gulp-concat-css, gulp-copy, gulp-less, gulp-watch, and github)
Remove run-sequence which is now deprecated and natively replaced with gulp.series
Fix calc() errors that arose out of interpolated strings with the latest version of gulp-less

With those tasks complete, npm install works and completes as intended with no errors and 0 security vulnerabilities.

y0hami · 2018-09-05T21:12:56Z

This is great this will help a bunch!

acconrad · 2018-09-06T02:37:19Z

May be worth waiting until this is merged to fully resolve all audit issues on dependencies

jlukic · 2018-09-17T00:53:05Z

I wasnt able to get the tasks to run with this PR. Is this a work in progress?

acconrad · 2018-09-21T16:38:33Z

Alright gulp-copy 4 is merged I'll take another look now to make sure the tasks run

acconrad · 2018-09-28T18:37:04Z

@jlukic Okay this is now complete. You can run npm install and gulp and all tasks will successfully complete with no errors and no security vulnerabilities.

y0hami · 2018-09-28T23:13:20Z

@acconrad Great, I will take a look at this when I have some time!

y0hami · 2018-10-01T07:44:32Z

@acconrad I just did some testing and it all looks good. The only problem I can find is when running gulp build-docs it will crash with TypeError [ERR_INVALID_CALLBACK]: Callback must be a function. It seems line 83 in tasks/docs/build.js is the problem because in newer versions of node the fs.writeFile function throws an error when there is no callback. If I remember correctly this was introduced in node v9.

acconrad · 2018-10-01T14:41:04Z

Cool @hammy2899 fixed!

y0hami

LGTM

acconrad · 2018-10-02T19:01:41Z

@hammy2899 added a commit that should get your PR to work now :)

jlukic · 2018-10-07T18:59:53Z

All of the calc variables need to pull from their respective variables (instead of being hard-coded) otherwise they wont adjust properly with user themes.

You'd want to be able to, for example change @ribbonMargin in label and have all other variables update properly.

jlukic · 2018-10-07T19:05:33Z

Maybe related to
less/less.js#3191
less/less.js#3223

acconrad · 2018-10-08T13:50:55Z

Good find @jlukic I had trouble finding that resolution, all fixed now!

jlukic · 2018-10-13T22:12:23Z

I've merged #6512 which updates calcs for compatibility with less 3.5.

Can you take a look at that and see if it can fit into your PR? A simple way to confirm is to inspect an attached menu and verify its calc(100% + (-1px * 2))

acconrad · 2018-10-14T02:24:21Z

package.json

-    "gulp-debug": "*",
-    "gulp-git": "*",
-    "gulp-tap": "*",
-    "merge-stream": "*"


This was in both dependencies and dev dependencies and the latest version right now is 1.0.1 anyway so you shouldn't have this in both sections, that will trigger an NPM warning

acconrad · 2018-10-14T02:29:41Z

@jlukic okay merged in. i verified everything looked right and the build still passes when building from npm and gulp.

acconrad · 2018-10-22T12:40:32Z

sorry about all of the bumps, this was during Github's outage this weekend and it kept telling me that no comments were going through (I even tried deleting all of them and they keep coming back), @jlukic @hammy2899 ready to merge when you are

jlukic · 2018-10-25T17:41:43Z

I was on vacation with family in Ireland, will probably have a chance to look this weekend or next.

acconrad · 2018-11-05T18:04:18Z

This ready to merge?

pgobin-zz · 2018-11-11T03:55:12Z

This ready to merge?

@acconrad @jlukic ./tasks/config/npm/gulpfile.js needs to be updated to match the new gulpfile.js.

acconrad · 2018-11-11T15:24:54Z

all set @pgobin

pgobin-zz · 2018-11-11T23:34:25Z

@acconrad Have you noticed file.path no longer exists in watch.js?

From watch.js:

gulp
    .watch([
      source.config,
      source.definitions   + '/**/*.less',
      source.site          + '/**/*.{overrides,variables}',
      source.themes        + '/**/*.{overrides,variables}'
    ], function(file) {

    ...

    gulp.src(file.path)
              ^
    ...

For me, gulp watch outputs an undefined exception after editing .less or an override.

If it indeed does, a solution might look something like the following:

  const cssWatcher = gulp.watch([
    source.config,
    source.definitions   + '/**/*.less',
    source.site          + '/**/*.{overrides,variables}',
    source.themes        + '/**/*.{overrides,variables}'
  ]);

  cssWatcher.on('change', (path) => {

    ...

    gulp.src(path)

    ...

For the CSS watch and the remaining watches also.

acconrad · 2018-11-12T02:33:32Z

@pgobin it wasn't there before I started this PR and this PR doesn't touch file.path so I would recommend you fix this in a separate PR

acconrad · 2018-12-31T01:12:05Z

Are we ready to merge this? Still would love to get this one in for my team!

badgerwithagun · 2019-01-14T09:21:54Z

@jlukic? @levithomason? Can this be merged? Just this and a patch release would get the library building without security warnings...

acconrad · 2019-01-29T14:23:54Z

Pinging @jlukic and @hammy2899 ... this has been ready for 2 months and could have positive security impacts for lots of folks :)

y0hami · 2019-01-29T14:36:03Z

@acconrad You will have to wait for @jlukic to merge this.

If you haven't noticed all PR's are currently stale...

Upgrade to Gulp 4.

badgerwithagun · 2019-01-29T18:04:21Z

package.json

    "gulp-clone": "^2.0.1",
    "gulp-concat": "^2.6.1",
    "gulp-concat-css": "^3.1.0",
    "gulp-copy": "4.0.1",
    "gulp-dedupe": "0.0.2",
    "gulp-flatten": "^0.4.0",
    "gulp-header": "^2.0.5",
-    "gulp-help": "^1.6.1",
+    "gulp-help": "github:chmontgomery/gulp-help#gulp4",


I'm just reviewing these changes to merge into my own fork and saw this. Given that this PR is intended to solve security warnings, I don't think we can trust adding a dependency on a floating github branch. It could be modified at any time, making builds unrepeatable and adding an attack vector.

Is there no published version that can be used?

There is never going to be a gulp4 release of gulp-help chmontgomery/gulp-help#31 (comment)

How about referencing the commit hash of the HEAD of that branch?

This should work (never tried it though):

github:chmontgomery/gulp-help#194e80e0545ff6af5d10eeba7e224d0da71eb8d3

Not sure the github dependency is needed either. This is standard:

git@github.com:github:chmontgomery/gulp-help.git#194e80e0545ff6af5d10eeba7e224d0da71eb8d3

E2A: yup

@badgerwithagun You could also check out the Fomantic-UI fork at https://github.com/fomantic/Fomantic-UI . We already have updated to gulp 4 and gulp-help will be removed with the next release

badgerwithagun · 2019-01-29T18:14:19Z

package.json

    "wrench-sui": "^0.0.3",
    "yamljs": "^0.3.0"
  },
  "devDependencies": {
-    "github": "*",
+    "github": "^14.0.0",


See above. Not certain that this is needed.

maxhq · 2019-08-30T07:41:15Z

Is there anything that stops this PR from being merged? Any help needed?

y0hami · 2019-08-30T07:55:17Z

@maxhq Give https://github.com/fomantic/Fomantic-UI a try it has gulp4 support and is activity maintained

acconrad · 2019-10-29T14:22:36Z

ping

y0hami · 2019-10-29T15:58:37Z

@acconrad This will most likely never be merged, its over 1 year now since last release of SUI (https://github.com/Semantic-Org/Semantic-UI/releases)

I would recommend anyone looking at this to take a look at Fomantic-UI the official community fork which has gulp4 support.

vsubbotskyy · 2019-10-29T17:12:11Z

Upgraded yesterday to Fomantic, supersmooth, no issues

acconrad added 2 commits September 5, 2018 16:07

Upgrade to Gulp4 to resolve security issues

c8b1edf

remove additional vulnerabilities

27f2bf4

y0hami added the Evaluating Bug / Change label Sep 5, 2018

y0hami assigned jlukic Sep 5, 2018

y0hami mentioned this pull request Sep 6, 2018

[Build Tools] update to gulp4 fomantic/Fomantic-UI#112

Closed

acconrad added 3 commits September 21, 2018 12:49

add in gulp-copy

78dcdc4

fixing gulp.start and run sequences

fd1d6d3

fix tasks and remove bad Less interpolation code

28b7a2c

remove excess console calls

d3da75c

fix build docs issue

bcc0839

y0hami approved these changes Oct 1, 2018

View reviewed changes

y0hami mentioned this pull request Oct 2, 2018

2.6.1 fomantic/Fomantic-UI#144

Merged

correctly end task

181c497

fix escaped strings for LESS variables files

d10064f

updates from master

dedde24

acconrad commented Oct 14, 2018

View reviewed changes

match tasks config npm gulpfile to main one

624ed30

dastrong mentioned this pull request Dec 28, 2018

Custom Themes (Semantic UI) chingu-voyages/geckos-project-16#58

Closed

badgerwithagun mentioned this pull request Jan 14, 2019

Semantic UI looks dead. What to do next? gruelbox/orko#139

Closed

badgerwithagun added a commit to badgerwithagun/Semantic-UI that referenced this pull request Jan 29, 2019

Merge pull request Semantic-Org#6566 from acconrad/acc-upgrade-gulp4

9d2af7e

Upgrade to Gulp 4.

badgerwithagun reviewed Jan 29, 2019

View reviewed changes

acconrad closed this Oct 29, 2019

[Dependencies] [Security] Upgrade to Gulp4 #6566

[Dependencies] [Security] Upgrade to Gulp4 #6566

Conversation

acconrad commented Sep 5, 2018 • edited Loading

y0hami commented Sep 5, 2018

acconrad commented Sep 6, 2018 • edited Loading

jlukic commented Sep 17, 2018

acconrad commented Sep 21, 2018 • edited Loading

acconrad commented Sep 28, 2018

y0hami commented Sep 28, 2018

y0hami commented Oct 1, 2018

acconrad commented Oct 1, 2018

y0hami left a comment

Choose a reason for hiding this comment

acconrad commented Oct 2, 2018

jlukic commented Oct 7, 2018 • edited Loading

jlukic commented Oct 7, 2018

acconrad commented Oct 8, 2018

jlukic commented Oct 13, 2018

acconrad Oct 14, 2018

Choose a reason for hiding this comment

acconrad commented Oct 14, 2018

acconrad commented Oct 22, 2018 • edited Loading

jlukic commented Oct 25, 2018

acconrad commented Nov 5, 2018

pgobin-zz commented Nov 11, 2018 • edited Loading

acconrad commented Nov 11, 2018

pgobin-zz commented Nov 11, 2018

acconrad commented Nov 12, 2018

acconrad commented Dec 31, 2018

badgerwithagun commented Jan 14, 2019

acconrad commented Jan 29, 2019

y0hami commented Jan 29, 2019

badgerwithagun Jan 29, 2019

Choose a reason for hiding this comment

y0hami Jan 29, 2019

Choose a reason for hiding this comment

badgerwithagun Jan 29, 2019 • edited Loading

Choose a reason for hiding this comment

ColinFrick Jan 29, 2019

Choose a reason for hiding this comment

badgerwithagun Jan 29, 2019

Choose a reason for hiding this comment

maxhq commented Aug 30, 2019

y0hami commented Aug 30, 2019

acconrad commented Oct 29, 2019

y0hami commented Oct 29, 2019

vsubbotskyy commented Oct 29, 2019 • edited Loading

acconrad commented Sep 5, 2018 •

edited

Loading

acconrad commented Sep 6, 2018 •

edited

Loading

acconrad commented Sep 21, 2018 •

edited

Loading

jlukic commented Oct 7, 2018 •

edited

Loading

acconrad commented Oct 22, 2018 •

edited

Loading

pgobin-zz commented Nov 11, 2018 •

edited

Loading

badgerwithagun Jan 29, 2019 •

edited

Loading

vsubbotskyy commented Oct 29, 2019 •

edited

Loading