darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2025-12-09 06:33:52 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
e81f27b3b02352db4d89071573e398468fbc7051
notifications-admin/package.json

74 lines
2.1 KiB
JSON
Raw Normal View History

Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
{
"name": "notifications-admin",
"version": "0.0.1",
update package.json for gsa
2022-11-29 08:55:22 -05:00
"description": "Admin front end for Notify",
Use EcmaScript 6, w/ transpiling for compatibility ES6 has some nice new features. Specifically relevant to this piece of work are: Arrow functions[1], whose `this` context is bound the value of `this` in the current scope and can’t be overidden. The code is cleaner as a result, and doesn’t need the addition of a bind polyfill for older browsers. Template strings[2], which are similar to triple-quoted multi line strings in Python. This means less fiddly and error-prone string concatenation. This commit adds Babel[3] to the Gulp pipeline. This transpiles Javascript written to the ES6 specification into code which is compatible with older browsers that don’t understand ES6 syntax. It also rewrites the gulpfile itself using some ES6 syntax, for the same reasons. 1. https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Functions/Arrow_functions 2. https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/template_strings 3. https://babeljs.io
2015-12-20 00:00:01 +00:00
"engines": {
Remove version restrictions for NPM We do need NPM to be run above those versions but I'd rather enforce that here after I'm sure this app will run on images that have a valid version.
2021-09-15 16:24:01 +01:00
"node": ">=10.15.3"
Use EcmaScript 6, w/ transpiling for compatibility ES6 has some nice new features. Specifically relevant to this piece of work are: Arrow functions[1], whose `this` context is bound the value of `this` in the current scope and can’t be overidden. The code is cleaner as a result, and doesn’t need the addition of a bind polyfill for older browsers. Template strings[2], which are similar to triple-quoted multi line strings in Python. This means less fiddly and error-prone string concatenation. This commit adds Babel[3] to the Gulp pipeline. This transpiles Javascript written to the ES6 specification into code which is compatible with older browsers that don’t understand ES6 syntax. It also rewrites the gulpfile itself using some ES6 syntax, for the same reasons. 1. https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Functions/Arrow_functions 2. https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/template_strings 3. https://babeljs.io
2015-12-20 00:00:01 +00:00
},
Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
"scripts": {
Separate test and lint steps
2022-10-27 11:10:13 -04:00
"lint": "gulp lint",
"test": "jest --config tests/javascripts/jest.config.js tests/javascripts",
Rename module HighlightTags was bad because: - we haven’t called placeholders ‘tags’ for a long time - it also does resizing of the `<textarea>`, not just highlighting the placeholders
2019-10-16 15:20:05 +01:00
"test-watch": "jest --watch --config tests/javascripts/jest.config.js tests/javascripts",
Fix flakiness with Gulp + Travis Gulp was failing silently on Travis. I tracked this down to the task that builds a custom, slimmed-down version of jQuery from source. To fix this I’ve removed the task and replaced it with just `src`ing the minified version of jQuery from `node_modules`. Cons: - A few more kb of JS Pros: - Less random, afternoon-chewing complexity
2016-01-12 13:37:50 +00:00
"build": "gulp",
Fix missing audit task in package.json This was intended to go in [^1] but I think it got lost in a rebase. [^1]: https://github.com/alphagov/notifications-admin/pull/4237
2022-05-10 11:33:24 +01:00
"watch": "gulp watch",
- Added new flag imagery for favicon and related images - Removed preloaded fonts - legacy UK site stuff - Added the ability to run pa11y scan with npm run pa11y-ci
2023-09-20 13:52:54 -04:00
"audit": "better-npm-audit audit --production --level low",
"pa11y-ci": "pa11y-ci"
Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
},
"repository": {
"type": "git",
update package.json for gsa
2022-11-29 08:55:22 -05:00
"url": "git+https://github.com/GSA/notifications-admin.git"
Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
},
update package.json for gsa
2022-11-29 08:55:22 -05:00
"author": "General Services Administration",
"license": "CC0",
"homepage": "https://github.com/GSA/notifications-admin#readme",
fix vulnerability
2024-06-17 14:27:59 -07:00
"overrides": {
hmm
2024-06-17 14:36:06 -07:00
"graceful-fs": "^4.2.11"
fix vulnerability
2024-06-17 14:27:59 -07:00
},
Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
"dependencies": {
Bump @rollup/plugin-commonjs from 28.0.2 to 28.0.3 Bumps [@rollup/plugin-commonjs](https://github.com/rollup/plugins/tree/HEAD/packages/commonjs) from 28.0.2 to 28.0.3. - [Changelog](https://github.com/rollup/plugins/blob/master/packages/commonjs/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/commonjs-v28.0.3/packages/commonjs) --- updated-dependencies: - dependency-name: "@rollup/plugin-commonjs" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-03-06 23:56:27 +00:00
"@rollup/plugin-commonjs": "^28.0.3",
Bump @rollup/plugin-node-resolve from 16.0.0 to 16.0.1 Bumps [@rollup/plugin-node-resolve](https://github.com/rollup/plugins/tree/HEAD/packages/node-resolve) from 16.0.0 to 16.0.1. - [Changelog](https://github.com/rollup/plugins/blob/master/packages/node-resolve/CHANGELOG.md) - [Commits](https://github.com/rollup/plugins/commits/node-resolve-v16.0.1/packages/node-resolve) --- updated-dependencies: - dependency-name: "@rollup/plugin-node-resolve" dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-03-11 23:18:00 +00:00
"@rollup/plugin-node-resolve": "^16.0.1",
Updated rollup
2024-08-08 14:32:33 -06:00
"@rollup/stream": "^3.0.1",
Bump @uswds/uswds from 3.12.0 to 3.13.0 Bumps [@uswds/uswds](https://github.com/uswds/uswds) from 3.12.0 to 3.13.0. - [Release notes](https://github.com/uswds/uswds/releases) - [Commits](https://github.com/uswds/uswds/compare/v3.12.0...v3.13.0) --- updated-dependencies: - dependency-name: "@uswds/uswds" dependency-version: 3.13.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 23:31:27 +00:00
"@uswds/uswds": "^3.13.0",
Support registering a new authenticator This adds Yubico's FIDO2 library and two APIs for working with the "navigator.credentials.create()" function in JavaScript. The GET API uses the library to generate options for the "create()" function, and the POST API decodes and verifies the resulting credential. While the options and response are dict-like, CBOR is necessary to encode some of the byte-level values, which can't be represented in JSON. Much of the code here is based on the Yubico library example [1][2]. Implementation notes: - There are definitely better ways to alert the user about failure, but window.alert() will do for the time being. Using location.reload() is also a bit jarring if the page scrolls, but not a major issue. - Ideally we would use window.fetch() to do AJAX calls, but we don't have a polyfill for this, and we use $.ajax() elsewhere [3]. We need to do a few weird tricks [6] to stop jQuery trashing the data. - The FIDO2 server doesn't serve web requests; it's just a "server" in the sense of WebAuthn terminology. It lives in its own module, since it needs to be initialised with the app / config. - $.ajax returns a promise-like object. Although we've used ".fail()" elsewhere [3], I couldn't find a stub object that supports it, so I've gone for ".catch()", and used a Promise stub object in tests. - WebAuthn only works over HTTPS, but there's an exception for "localhost" [4]. However, the library is a bit too strict [5], so we have to disable origin verification to avoid needing HTTPS for dev work. [1]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/server.py [2]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/examples/server/static/register.html [3]: https://github.com/alphagov/notifications-admin/blob/91453d36395b7a0cf2998dfb8a5f52cc9e96640f/app/assets/javascripts/updateContent.js#L33 [4]: https://stackoverflow.com/questions/55971593/navigator-credentials-is-null-on-local-server [5]: https://github.com/Yubico/python-fido2/blob/c42d9628a4f33d20c4401096fa8d3fc466d5b77f/fido2/rpid.py#L69 [6]: https://stackoverflow.com/questions/12394622/does-jquery-ajax-or-load-allow-for-responsetype-arraybuffer
2021-05-07 18:10:07 +01:00
"cbor-js": "0.1.0",
Added d3
2024-08-09 10:48:39 -06:00
"d3": "^7.9.0",
Updated govuk-fe-toolkit
2024-07-03 13:48:03 -06:00
"govuk_frontend_toolkit": "^9.0.1",
Add GOVUK Frontend NPM module The GOVUK Frontend Jinja extension adds this as an extra location to source templates from.
2019-10-03 12:59:26 +01:00
"govuk-frontend": "2.13.0",
Replaced stream queue
2024-08-08 14:01:05 -06:00
"gulp-merge": "^0.1.1",
Add a page to manage a service’s whitelist Services who are in alpha or building prototypes need a way of sending to any email address or phone number without having to sign the MOU. This commit adds a page where they can whitelist up to 5 email addresses and 5 phone numbers. It uses the ‘list entry’ UI pattern from the Digital Marketplace frontend toolkit [1] [2] [3]. I had to do some modification: - of the Javascript, to make it work with the GOV.UK Module pattern - of the template to make it work with WTForms - of the content security policy, because the list entry pattern uses Hogan[1], which needs to use `eval()` (this should be fine if we’re only allowing it for scripts that we serve) - of our SASS lint config, to allow browser-targeting mixins to come after normal rules (so that they can override them) This commit also adds a new form class to validate and populate the two whitelists. The validation is fairly rudimentary at the moment, and doesn’t highlight which item in the list has the error, but it’s probably good enough. The list can only be updated all-at-once, this is how it’s possible to remove items from the list without having to make multiple `POST` requests. 1. https://github.com/alphagov/digitalmarketplace-frontend-toolkit/blob/434ad307913651ecb041ab94bdee748ebe066d1a/toolkit/templates/forms/list-entry.html 2. https://github.com/alphagov/digitalmarketplace-frontend-toolkit/blob/434ad307913651ecb041ab94bdee748ebe066d1a/toolkit/scss/forms/_list-entry.scss 3. https://github.com/alphagov/digitalmarketplace-frontend-toolkit/blob/434ad307913651ecb041ab94bdee748ebe066d1a/toolkit/javascripts/list-entry.js 4. http://twitter.github.io/hogan.js/
2016-09-20 12:30:00 +01:00
"hogan": "1.0.2",
initial
2024-06-17 13:55:25 -07:00
"jquery": "3.7.1",
Bump morphdom from 2.7.4 to 2.7.5 Bumps [morphdom](https://github.com/patrick-steele-idem/morphdom) from 2.7.4 to 2.7.5. - [Changelog](https://github.com/patrick-steele-idem/morphdom/blob/master/CHANGELOG.md) - [Commits](https://github.com/patrick-steele-idem/morphdom/compare/v2.7.4...v2.7.5) --- updated-dependencies: - dependency-name: morphdom dependency-version: 2.7.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-04-22 14:04:19 +00:00
"morphdom": "^2.7.5",
Bump playwright from 1.52.0 to 1.53.0 Bumps [playwright](https://github.com/microsoft/playwright) from 1.52.0 to 1.53.0. - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](https://github.com/microsoft/playwright/compare/v1.52.0...v1.53.0) --- updated-dependencies: - dependency-name: playwright dependency-version: 1.53.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-10 23:36:57 +00:00
"playwright": "^1.53.0",
Initial USWDS install
2023-04-24 14:57:35 -04:00
"python": "^0.0.4",
Make relative timestamps update automatically It’s weird to be on a page that says ‘2 seconds ago’ and stays stuck there. We don’t want to AJAX the whole page because it would get in the way of interacting with the list of notifications. This commit adds the venerable jQuery Timeago[1] plugin to keep the relative times accurate and fresh. 1. http://timeago.yarp.com/
2016-09-28 17:47:40 +01:00
"query-command-supported": "1.0.0",
Bump sass-embedded from 1.89.1 to 1.89.2 Bumps [sass-embedded](https://github.com/sass/embedded-host-node) from 1.89.1 to 1.89.2. - [Changelog](https://github.com/sass/embedded-host-node/blob/main/CHANGELOG.md) - [Commits](https://github.com/sass/embedded-host-node/compare/1.89.1...1.89.2) --- updated-dependencies: - dependency-name: sass-embedded dependency-version: 1.89.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-10 14:49:29 +00:00
"sass-embedded": "^1.89.2",
install socket
2025-04-09 17:11:09 -07:00
"socket.io-client": "^4.8.1",
Bump Gulp to 4.0.0 Brings in a new API which is a breaking change: https://github.com/gulpjs/gulp/blob/master/CHANGELOG.md#400 Requires gulpfile.babel.js to be a CommonJS module and for all tasks to be exported. Replaces using ES6 modules for the CommonJS to include other packages to match the type of module the gulpfile now is. Updates to 4.0.0 include `series` and `parallel` methods which remove the need for the `run-sequence` package. Also bumps gulp-specific libraries.
2019-04-01 09:58:13 +01:00
"textarea-caret": "3.1.0",
Updated rollup
2024-08-08 14:32:33 -06:00
"vinyl-buffer": "^1.0.1",
"vinyl-source-stream": "^2.0.0"
Add linting for SASS and Javascript Similar to how PEP8 enforces Python style, there are tools for front end code: - jshint[1] for Javascript - sass-lint[2] for SASS This commit adds the Gulp plugins for both, and sets up some sensible rules (which can be iterated on). It also adds a command to `./scripts/run_tests.sh`, so that any errors in the front end code will fail the build before it has a chance to be deployed. 1. http://jshint.com/ 2. https://www.npmjs.com/package/sass-lint
2016-02-08 11:05:07 +00:00
},
"devDependencies": {
Bump @babel/core from 7.27.3 to 7.27.4 Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.27.3 to 7.27.4. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.27.4/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.27.4 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-05-30 23:50:39 +00:00
"@babel/core": "^7.27.4",
Bump @babel/preset-env from 7.27.1 to 7.27.2 Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.27.1 to 7.27.2. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.27.2/packages/babel-preset-env) --- updated-dependencies: - dependency-name: "@babel/preset-env" dependency-version: 7.27.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-05-06 23:43:29 +00:00
"@babel/preset-env": "^7.27.2",
Bump @uswds/compile from 1.2.2 to 1.3.1 Bumps [@uswds/compile](https://github.com/uswds/uswds-compile) from 1.2.2 to 1.3.1. - [Release notes](https://github.com/uswds/uswds-compile/releases) - [Commits](https://github.com/uswds/uswds-compile/compare/v1.2.2...v1.3.1) --- updated-dependencies: - dependency-name: "@uswds/compile" dependency-version: 1.3.1 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2025-05-22 23:06:08 +00:00
"@uswds/compile": "^1.3.1",
Backstop is working locally
2024-09-18 13:59:16 -04:00
"backstopjs": "^6.3.25",
Bump better-npm-audit from 3.8.3 to 3.11.0 Bumps [better-npm-audit](https://github.com/jeemok/better-npm-audit) from 3.8.3 to 3.11.0. - [Release notes](https://github.com/jeemok/better-npm-audit/releases) - [Changelog](https://github.com/jeemok/better-npm-audit/blob/master/CHANGELOG.md) - [Commits](https://github.com/jeemok/better-npm-audit/compare/v3.8.3...v3.11.0) --- updated-dependencies: - dependency-name: better-npm-audit dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2024-09-10 18:28:31 +00:00
"better-npm-audit": "^3.11.0",
Bump gulp from 5.0.0 to 5.0.1 Bumps [gulp](https://github.com/gulpjs/gulp) from 5.0.0 to 5.0.1. - [Release notes](https://github.com/gulpjs/gulp/releases) - [Changelog](https://github.com/gulpjs/gulp/blob/master/CHANGELOG.md) - [Commits](https://github.com/gulpjs/gulp/compare/v5.0.0...v5.0.1) --- updated-dependencies: - dependency-name: gulp dependency-version: 5.0.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-11 00:13:31 +00:00
"gulp": "^5.0.1",
hmm
2024-06-17 14:36:06 -07:00
"gulp-add-src": "^1.0.0",
Fix incorrect group for NPM dependencies This means we can use tools like "npm audit" to look for security vulnerabilities we definitely need to fix as they could pose a direct risk to users. I've checked each of them with @tombye and also against an external set of principles [^1]. Note: I've skimmed through the package-lock.json to check the only changes are to add "dev: true", as well as a few integrity hashes. [^1]: https://betterprogramming.pub/is-this-a-dependency-or-a-devdependency-678e04a55a5c
2022-05-05 14:52:32 +01:00
"gulp-babel": "8.0.0",
"gulp-clean-css": "4.3.0",
Replaced stream queue
2024-08-08 14:01:05 -06:00
"gulp-concat": "^2.6.1",
Add better-npm-audit to check production packages This is the same as [^1]. [^1]: https://github.com/alphagov/document-download-frontend/pull/120
2022-05-06 15:34:54 +01:00
"gulp-include": "2.4.1",
Update NPM packages to the latest version
2018-01-17 16:50:39 +00:00
"gulp-jshint": "2.1.0",
Bump gulp-sass Intended to deal with this security vulnerability: https://github.blog/2021-09-08-github-security-update-vulnerabilities-tar-npmcli-arborist/ Bumping gulp-sass to version 5 removes its dependency on the tar package mentioned in that article. Version 5 requires you to specify a compiler directly in the gulpfile so that code is changed in line with this guidance: https://github.com/dlmanning/gulp-sass/tree/master#migrating-to-version-5 Note: node-sass is now deprecated so this also changes the sass compiler gulp-sass uses to dart-sass (aka 'sass'), the compiler now recommended by the Sass project: https://sass-lang.com/dart-sass This also bumps gulp and all its plugin modules to their latest versions, for parity.
2021-09-09 14:33:30 +01:00
"gulp-prettyerror": "2.0.0",
Add better-npm-audit to check production packages This is the same as [^1]. [^1]: https://github.com/alphagov/document-download-frontend/pull/120
2022-05-06 15:34:54 +01:00
"gulp-uglify": "3.0.2",
Bump jest from 29.7.0 to 30.0.0 Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) from 29.7.0 to 30.0.0. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.0.0/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-version: 30.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-10 23:37:28 +00:00
"jest": "^30.0.0",
Bump jest-each from 29.7.0 to 30.0.0 Bumps [jest-each](https://github.com/jestjs/jest/tree/HEAD/packages/jest-each) from 29.7.0 to 30.0.0. - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.0.0/packages/jest-each) --- updated-dependencies: - dependency-name: jest-each dependency-version: 30.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-11 00:13:27 +00:00
"jest-each": "^30.0.0",
Update tests to use most recent jest and supporting libraries
2022-10-27 11:12:39 -04:00
"jest-environment-jsdom": "^29.2.2",
more updated
2024-06-18 07:49:20 -07:00
"jshint": "2.13.6",
Add JS modules support & use for GOVUKFrontend The JS for GOVUKFrontend components is available individually so you can only include what you need: https://github.com/alphagov/govuk-frontend/blob/v2.13.0/docs/installation/installing-with-npm.md#option-2-import-javascript This uses the JS Modules syntax: *[JS module](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) Our JS is delivered as one file so we need to use a bundler to convert the modules to a single file. This adds a build step to transpile all modules into a single file, which is then added to the files combined into the one that get delivered. Rollup is used as the simplest bundler to use for this purpose. It also introduces the least boilerplate JS. Note: the CommonJS plugin is needed as GOV.UK Frontend components are published as UMD modules. In future, this work should let us work on this story dependencies: https://www.pivotaltracker.com/story/show/165380360
2019-10-11 10:26:25 +01:00
"jshint-stylish": "2.2.1",
Bump rollup from 4.42.0 to 4.43.0 Bumps [rollup](https://github.com/rollup/rollup) from 4.42.0 to 4.43.0. - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](https://github.com/rollup/rollup/compare/v4.42.0...v4.43.0) --- updated-dependencies: - dependency-name: rollup dependency-version: 4.43.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-11 23:40:58 +00:00
"rollup": "^4.43.0",
Add JS modules support & use for GOVUKFrontend The JS for GOVUKFrontend components is available individually so you can only include what you need: https://github.com/alphagov/govuk-frontend/blob/v2.13.0/docs/installation/installing-with-npm.md#option-2-import-javascript This uses the JS Modules syntax: *[JS module](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules) Our JS is delivered as one file so we need to use a bundler to convert the modules to a single file. This adds a build step to transpile all modules into a single file, which is then added to the files combined into the one that get delivered. Rollup is used as the simplest bundler to use for this purpose. It also introduces the least boilerplate JS. Note: the CommonJS plugin is needed as GOV.UK Frontend components are published as UMD modules. In future, this work should let us work on this story dependencies: https://www.pivotaltracker.com/story/show/165380360
2019-10-11 10:26:25 +01:00
"rollup-plugin-commonjs": "10.1.0",
Added simple package updates
2024-08-08 13:58:33 -06:00
"rollup-plugin-node-resolve": "5.2.0"
Use a Node-based tools for handling assets …or how to move a bunch of things from a bunch of different places into `app/static`. There are three main reasons not to use Flask Assets: - It had some strange behaviour like only - It was based on Ruby SASS, which is slower to get new features than libsass, and meant depending on Ruby, and having the SASS Gem globally installed—so you’re already out of being a ‘pure’ Python app - Martyn and I have experience of doing it this way on Marketplace, and we’ve ironed out the initial rough patches The specific technologies this introduces, all of which are Node-based: - Gulp – like a Makefile written in Javascript - NPM – package management, used for managing Gulp and its related dependencies - Bower – also package management, and the only way I can think to have GOV.UK template as a proper dependency …speaking of which, GOV.UK template is now a dependency. This means it can’t be modified at all (eg to add a global `#content` wrapper), so every page now inherits from a template that has this wrapper. But it also means that we have a clean upgrade path when the template is modified. Everything else (toolkit, elements) I’ve kept as submodules but moved them to a more logical place (`app/assets` not `app/assets/stylesheets`, because they contain more than just SASS/CSS).
2015-12-15 08:20:25 +00:00
}
}
Reference in New Issue Copy Permalink