[pull] master from apache:master - #689
Merged
Merged
Conversation
…ppelin-react Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 4.3.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md">js-yaml's changelog</a>.</em></p> <blockquote> <h2>4.3.2 - 2026-08-26</h2> <h3>Changed</h3> <ul> <li>[backport] Hard-limit merge sequence size to 100.</li> </ul> <h3>Security</h3> <ul> <li>[backport] Count empty mappings in merge sequences toward <code>maxTotalMergeKeys</code> to limit CPU usage, <a href="https://redirect.github.com/nodeca/js-yaml/issues/797">#797</a>.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodeca/js-yaml/commit/79ca68d90f333fbe6d9e42827527e62636200191"><code>79ca68d</code></a> 4.3.2 released</li> <li><a href="https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"><code>d90b661</code></a> Backport merge limits from v5.4.1</li> <li>See full diff in <a href="https://github.com/nodeca/js-yaml/compare/4.3.1...4.3.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `<at>dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `<at>dependabot rebase` will rebase this PR - `<at>dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `<at>dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `<at>dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `<at>dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `<at>dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/zeppelin/network/alerts). </details> Closes #5471 from dependabot[bot]/dependabot/npm_and_yarn/zeppelin-web-angular/projects/zeppelin-react/js-yaml-4.3.2. Signed-off-by: YONGJAE LEE <dev.yongjaelee@gmail.com>
…interceptor
### What is this PR for?
The New UI never logs out on session expiry. `AppHttpInterceptor` guards its 405 branch with `event.url.contains('logout')`, and JavaScript strings have no `contains` method, so the guard throws a `TypeError` inside `catchError` before `ticketService.logout()` is reached. Both statements after it are skipped: logout never runs, and the caller observes a `TypeError` instead of the 405 it needs to act on. The expired session stays in place until the user reloads the page by hand.
The guard's intent is right and is kept. It exists so that a 405 on the logout request itself does not call logout again, which would recurse. Only the method name changes:
```diff
-} else if (event.status === 405 && !event.url.contains('logout')) {
+} else if (event.status === 405 && !event.url?.includes('logout')) {
```
`includes` is the method that exists. The optional chain covers `HttpErrorResponse.url` being `null`, which it is whenever the failure carries no resolved url, and which would otherwise throw at the same spot for a different reason. A 405 with no url cannot be identified as the logout call, so it falls through to logout — the same conclusion the branch already draws for every other request, and the safe one when the session is likely gone.
The 401 redirect branch is untouched.
Out of scope, and left alone deliberately: the substring match means a 405 on a path that merely contains `logout` is also skipped, and the `catchError` parameter is untyped. Both belong to [ZEPPELIN-6469](https://issues.apache.org/jira/browse/ZEPPELIN-6469), which waits on this behaviour being correct first.
The spec constructs the interceptor directly with a `logout` stub rather than starting `TestBed`, per `zeppelin-web-angular/AGENTS.md`: no Angular wiring is under test here, only the branch. It pins three things the branch has to get right — a non-logout 405 calls logout exactly once, that 405 reaches the caller unchanged rather than replaced by a `TypeError`, and a 405 from the logout request itself does not call logout again — plus the null-url path.
### What type of PR is it?
Bug Fix
### Todos
None
### What is the Jira issue?
* https://issues.apache.org/jira/browse/ZEPPELIN-6643
### How should this be tested?
* `npm run test:shell` — 53 tests across 12 files, green. The four new ones are in `src/app/app-http.interceptor.spec.ts`.
* The assertions were checked by breaking what they cover. Reverting the source line to `event.url.contains('logout')` fails three of the four, with `AssertionError: expected TypeError: event.url.contains is not a function to be HttpErrorResponse`. The fourth — the recursion guard — passes either way, because the `TypeError` also happens to prevent the logout call; it is there to confirm the guard survives the fix, not to reproduce the bug.
* `npx prettier --check` on both files, clean. `npx eslint` on both reports only the two `prefer-arrow/prefer-arrow-functions` warnings that the named test helpers produce, the same two `src/app/services/save-as.service.spec.ts` already reports on master.
* Not run locally: Playwright, and the production builds. Neither is reachable from this change — it is one expression in an interceptor plus a unit spec — but saying so rather than implying otherwise.
Manual reproduction, for a reviewer who wants to see the original failure: with an expired session, any REST call from the New UI answers 405 and the browser console shows `event.url.contains is not a function` from the interceptor, with no logout request following it. After this change the same 405 is followed by `POST /api/login/logout`.
### Screenshots (if appropriate)
Not applicable.
### Questions:
* Does the license files need to update? No
* Is there breaking changes for older versions? No. The 405 branch did nothing but throw before this change, so nothing could have depended on it.
* Does this needs documentation? No
Closes #5464 from kimyenac/ZEPPELIN-6643.
Signed-off-by: YONGJAE LEE <dev.yongjaelee@gmail.com>
…Angular and classic paths write ### What is this PR for? The React remote builds its CSV export by hand and hands the string straight to a `Blob` with no UTF-8 BOM, so Excel reads it in the system code page and garbles non-ASCII data. The classic path prepends one through `saveAsService`, and the Angular path gets one from `XLSX.writeFile()`, so only this export was missing it. ZEPPELIN-672 added the BOM for exactly this reason. ```diff - const blob = new Blob([content], { type: 'text/plain;charset=utf-8' }); + const BOM = '\uFEFF'; + const blob = new Blob([BOM, content], { type: 'text/plain;charset=utf-8' }); ``` The xlsx branch is left alone, since that format carries its own encoding. ### What type of PR is it? Bug Fix ### Todos * [x] Prepend the BOM in the React remote CSV export * [x] Add a regression test asserting the saved bytes ### What is the Jira issue? * [ZEPPELIN-6699](https://issues.apache.org/jira/browse/ZEPPELIN-6699) ### How should this be tested? New spec `exportFile.spec.ts` mocks `file-saver` and inspects the bytes handed to `saveAs`, since `Blob.text()` decodes and drops a leading BOM. ``` cd zeppelin-web-angular/projects/zeppelin-react && npm test ``` Result: `Tests 1 failed | 67 passed (68)`. The one failure is `HTMLRenderer.spec.tsx > highlights a code block`, which fails the same way on `origin/master` without this change. Running the new spec alone passes: ``` npx vitest run src/utils/exportFile.spec.ts → Tests 2 passed (2) ``` Reverting only the production change makes it fail with `expected [ 110, 97, 109 ] to deeply equal [ 239, 187, 191 ]`, so it does catch the defect. Manual: run a paragraph whose table result contains non-ASCII text, open the published paragraph with `?react=true`, and choose "Export all data as csv". The file now starts with `EF BB BF` and opens in Excel with the text intact. ### Screenshots (if appropriate) N/A ### Questions: * Does the license files need to update? No * Is there breaking changes for older versions? No — the BOM only makes the React export match what the other two paths already write * Does this needs documentation? No Note: the issue scopes this to CSV and TSV, but the React remote has no TSV path, since `exportFile()` only takes `'csv' | 'xlsx'`. I'll file that parity gap separately; the BOM sits on the shared branch, so a TSV path added there inherits it. Closes #5466 from xhaktm00/ZEPPELIN-6699. Signed-off-by: YONGJAE LEE <dev.yongjaelee@gmail.com>
…ppelin-react Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.8 to 4.1.11. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.11</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Revive global concurrency limit for test lifecycle [backport to v4] - by <a href="https://github.com/sheremet-va"><code><at>sheremet-va</code></a> and <a href="https://github.com/hi-ogawa"><code><at>hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10992">vitest-dev/vitest#10992</a> <a href="https://github.com/vitest-dev/vitest/commit/5146df80b"><!-- raw HTML omitted -->(5146d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Encode iframeId in tester iframe URL [backport to v4] - by <a href="https://github.com/sheremet-va"><code><at>sheremet-va</code></a>, <strong>Pduhard</strong> and <strong>Claude Opus 4.8</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10955">vitest-dev/vitest#10955</a> <a href="https://github.com/vitest-dev/vitest/commit/10b2cd201"><!-- raw HTML omitted -->(10b2c)<!-- raw HTML omitted --></a></li> <li>Trigger playwright/chromium gc on lower disk availability [backport to v4] - by <a href="https://github.com/hi-ogawa"><code><at>hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10951">vitest-dev/vitest#10951</a> <a href="https://github.com/vitest-dev/vitest/commit/9851dbc41"><!-- raw HTML omitted -->(9851d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Restrict redirect mocks to the fs allowlist [backport to v4] - by <a href="https://github.com/sheremet-va"><code><at>sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10974">vitest-dev/vitest#10974</a> <a href="https://github.com/vitest-dev/vitest/commit/fe5a11d3c"><!-- raw HTML omitted -->(fe5a1)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11">View changes on GitHub</a></h5> <h2>v4.1.10</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li><strong>browser</strong>: Check fs access in builtin commands [backport to v4] - by <a href="https://github.com/hi-ogawa"><code><at>hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (claude-opus-4-8)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10680">vitest-dev/vitest#10680</a> <a href="https://github.com/vitest-dev/vitest/commit/5c18dd267"><!-- raw HTML omitted -->(5c18d)<!-- raw HTML omitted --></a></li> <li><strong>vm</strong>: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4] - by <a href="https://github.com/SveLil"><code><at>SveLil</code></a> and <a href="https://github.com/hi-ogawa"><code><at>hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10661">vitest-dev/vitest#10661</a> <a href="https://github.com/vitest-dev/vitest/commit/bae52b511"><!-- raw HTML omitted -->(bae52)<!-- raw HTML omitted --></a></li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.9...v4.1.10">View changes on GitHub</a></h5> <h2>v4.1.9</h2> <h3>🐞 Bug Fixes</h3> <ul> <li>Fix <code>importOriginal</code> with optimizer and query import [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>David Harris</strong>, <strong>Codex</strong>and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10546">vitest-dev/vitest#10546</a> <a href="https://github.com/vitest-dev/vitest/commit/a5180190c"><!-- raw HTML omitted -->(a5180)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10555">vitest-dev/vitest#10555</a> <a href="https://github.com/vitest-dev/vitest/commit/7fb29651a"><!-- raw HTML omitted -->(7fb29)<!-- raw HTML omitted --></a></li> <li>Wait for iframe tester readiness before preparing [backport to v4] - by <strong>Vladimir</strong> and <strong>Séamus O'Connor</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10497">vitest-dev/vitest#10497</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10556">vitest-dev/vitest#10556</a> <a href="https://github.com/vitest-dev/vitest/commit/fbc626c40"><!-- raw HTML omitted -->(fbc62)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Hoist vi.mock() for vite-plus/test imports [backport to v4] - by <strong>Hiroshi Ogawa</strong>, <strong>LongYinan</strong>, <strong>Claude Opus 4.8</strong> and <strong>Vladimir</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10548">vitest-dev/vitest#10548</a> <a href="https://github.com/vitest-dev/vitest/commit/2c9559c02"><!-- raw HTML omitted -->(2c955)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>pool</strong>: <ul> <li>Prevent test run hang on worker crash [backport to v4] - by <strong>Ari Perkkiö</strong> and <strong>Jattioui Ismail</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10543">vitest-dev/vitest#10543</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/10564">vitest-dev/vitest#10564</a> <a href="https://github.com/vitest-dev/vitest/commit/934b0f587"><!-- raw HTML omitted -->(934b0)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5><a href="https://github.com/vitest-dev/vitest/compare/v4.1.8...v4.1.9">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/9bd8d464e6328c567c2dbcd8fdd977d57a9425c2"><code>9bd8d46</code></a> chore: release v4.1.11 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10995">#10995</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/9851dbc41c286a30abfb6b29cce65f3e5b7b40a1"><code>9851dbc</code></a> fix(browser): trigger playwright/chromium gc on lower disk availability [back...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/db616d227b6e0cb07a94f5d1bba262ee95db7e46"><code>db616d2</code></a> chore: release v4.1.10 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10718">#10718</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/bae52b5112a6fd8200101b88bf8af9685d077295"><code>bae52b5</code></a> fix(vm): fix external module resolve error with deps optimizer query for enco...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a7a61e78c7d0718f00173cff6800a91a344457d4"><code>a7a61e7</code></a> chore: release v4.1.9 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10598">#10598</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/934b0f587cb61d8338d83f525295322692a2db40"><code>934b0f5</code></a> fix(pool): prevent test run hang on worker crash (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10543">#10543</a>) [backport to v4] (#...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/7fb29651afbae2a9b0cefe6c031a9308f168ac60"><code>7fb2965</code></a> fix(browser): wait for orchestrator readiness before resolving browser sessio...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a5180190c1be7089e3705e3dd9e84fea118d09d3"><code>a518019</code></a> fix: fix <code>importOriginal</code> with optimizer and query import [backport to v4] (#...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest">compare view</a></li> </ul> </details> <br /> Closes #5470 from dependabot[bot]/dependabot/npm_and_yarn/zeppelin-web-angular/projects/zeppelin-react/vitest-4.1.11. Signed-off-by: YONGJAE LEE <dev.yongjaelee@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )