Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Lodash upgrade and cleanup #2990

Merged
merged 58 commits into from
May 27, 2020
Merged

Lodash upgrade and cleanup #2990

merged 58 commits into from
May 27, 2020

Conversation

JoelMcKinnon
Copy link
Contributor

To resolve the security exception for lodash versioning and to clean up and remove many lodash methods, took the following steps:

  1. Upgrade lodash and rename deprecated methods
  2. Change web pack aliases for utils, add array-utils and tests
  3. Change paths to use objectUtils alias
  4. Convert ._extend, _.findIndex to native
  5. Convert _.flatten, _.isEmpty, _.keyBy to use arrayUtils
  6. Convert _.find, _.isArray, _.isEvery to native
  7. Convert _.math.max, _.math.min, _.trim , _.invoke, _.isNaN to native
  8. Add missing lodash imports

Closed related PR: #2970

Author Checklist

  • Changes address original issue? Yes
  • Unit tests included and/or updated with changes? Yes
  • Command line build passes? Yes
  • Changes have been smoke-tested? Yes

shefalijoshi and others added 30 commits April 9, 2020 12:10
Copy link
Contributor

@akhenry akhenry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks really good. I don't think we can just bring "You don't need's" suggested code across verbatim though. It's covered by the MIT license. We would need to change them in some meaningful way, or just continue using lodash. I'm in favor of just continuing to use lodash in those cases for now, in the interests of getting this merged.

/* Retired lodash methods */

// keyBy for array only
export const keyBy = (array, key) => (array || []).reduce((acc, curr) => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A note on this pattern of declaring functions. My preference here would be to just export named functions. We are assigning a new variable here unnecessarily, and anonymous functions can be harder to debug. I would also not be in favor of assigning a named function to a constant, so I think named functions are the way to go.

There are different schools of thought about this convention. If you're interested in reading more about the issue, read AirBnB's justification for using a similar convention for functions and the associated discussion. To me their recommended approach involves basically naming functions twice for almost no benefit (to avoid function hoisting). I actually think function hoisting is a good thing, but that's another discussion...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case the problem is resolved by removing the library array-utils entirely for the reasons mentioned elsewhere in this PR. If and when it's needed I'll refer back to this for guidance.

.eslintrc.js Outdated
@@ -10,7 +10,9 @@ module.exports = {
},
"extends": [
"eslint:recommended",
"plugin:vue/recommended"
"plugin:vue/recommended",
"plugin:lodash/recommended",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to keep the lodash linter enabled

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed along with the associated rules

@@ -0,0 +1,46 @@
/*****************************************************************************
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I hate to say it, but I don't think we can in-house these functions. "you-don't-need" uses the MIT license, so if we use their code then we have to bring their license across as well. Which means we're no longer distributing under the Apache 2 license (approved by the NASA software release authority), we're also distributing under MIT.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK - will remove array-utils.js, array-utilsSpec.js, and webpack alias, and re-implement the lodash methods for these.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@@ -57,6 +57,7 @@ export default class ConditionManager extends EventEmitter {
endpoint,
this.telemetryReceived.bind(this, endpoint)
);
// TODO check if this is needed
Copy link
Contributor

@akhenry akhenry May 13, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove commented code

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

"plugin:vue/recommended"
"plugin:vue/recommended",
"plugin:lodash/recommended",
"plugin:you-dont-need-lodash-underscore/compatible"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 I like this, to remind people to use native functions wherever possible.

.eslintrc.js Outdated
@@ -22,6 +24,24 @@ module.exports = {
}
},
"rules": {
"you-dont-need-lodash-underscore/uniq": "off",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are all of these rules necessary? I don't see any usage of _.concat, or ._values for example? And we would definitely want to discourage usage of lodash in those cases.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll do a check and remove any unneeded rules

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In PlotSeries.js and in a few other files there is a pattern like:

var newPoints = _(this.data)
    .concat(points)
    .sortBy(this.getXVal)
    .uniq(true, point => [this.getXVal(point), this.getYVal(point)].join())
    .value();

Turning off the rules for _.uniq, _.concat, and _.values results in the following lint errors as a result of these patterns.

image

I assume each of these could be re-implemented natively, but not sure if you want me to tackle that in this PR.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same situation for _.map
image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OIC, I missed them because they're chained. Man, I would love to have the concat, values, and map checks enabled. It pretty significantly reduces the utility of having this check enabled.

Can we enable these checks globally, but disable them on a per-use basis? That way we can avoid future usage, but also not have to refactor these out right now.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a great idea - let me take a look at it.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Copy link
Contributor

@akhenry akhenry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good. Still three minor issues.

.eslintrc.js Outdated
@@ -10,7 +10,9 @@ module.exports = {
},
"extends": [
"eslint:recommended",
"plugin:vue/recommended"
"plugin:vue/recommended",
// "plugin:lodash/recommended",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be removed, not commented out.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

package.json Outdated
@@ -23,7 +23,9 @@
"d3-time": "1.0.x",
"d3-time-format": "2.1.x",
"eslint": "5.2.0",
"eslint-plugin-lodash": "^6.0.0",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd like to remove this, I don't think we're going to get much value from it, and I'm keen to keep our dependency base as small as possible.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

package.json Outdated
"markdown-toc": "^0.11.7",
"marked": "^0.3.5",
"mini-css-extract-plugin": "^0.4.1",
"minimist": "^1.1.1",
"moment": "2.25.3",
"moment": "^2.25.3",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to use the exact version of moment here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

@akhenry
Copy link
Contributor

akhenry commented May 27, 2020

@JoelMcKinnon Looks like there's a build issue now. It's due to a recently merged change that references testTools, which was renamed (correctly) testUtils in this branch. It's an easy fix.

@akhenry akhenry merged commit 43628ad into master May 27, 2020
@akhenry akhenry deleted the lodash-debug branch May 27, 2020 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants