The main goal of this issue is to avoid scanners (Dependabot
and friends), reporting about security issues with the current
xmldom 0.6.0 package.
Note that this doesn't affect prod at all, because it's a dev
dependency, hardly exploitable. So it's not a security fix, just
a security_benefit, if something.
So here, we are updating from xmldom 0.6.0 to @xmldom/xmldom 0.8.7
(note that the package was renamed in 0.7.0, so it's the very same)
Also, when proceeding with the changes, it was detected that we
are incorrectly declaring @babel/eslint-parser as a normal dependency
instead of a development one, so we are also fixing that little detail.
The commands executed to get the changes above applied have been:
- nvm use
- npm install @xmldom/xmldom@^0.8.7 --save-dev
- npm uninstall xmldom
- npm install @babel/eslint-parser@^7.17.0 --save-dev
(we haven't run a complete re-install because we only want to modify
the minimum possible at this stage).
This change reduces the priority of the shipped phpcs configuration to
allow for local overrides.
This is beneficial in several situations:
- when users wish to apply stricter or additional standards
- when the integration team wishes to trial new rules
This commit adds a new Grunt task which generates a jsconfig.json file.
This file is described at
https://code.visualstudio.com/docs/languages/jsconfig and can be used
to configure vscode and other similar editors to understand our module
loading.
This task is an optional task for Grunt and can be run with:
npx grunt jsconfig
The file is git-ignored and will not affect normal usage.
Moodle announced that support for IE would be dropped back in August
2020 with Moodle 3.9 but not active steps were taken at that time. That
decision was made in MDLSITE-6109 and this particular step was meant to
be taken in Moodle 3.10.
This is the first step taken to actively drop support for IE.
This commit also bumps the browser support pattern from 0.25% to 0.3%.
The percentage here includes any browser where at least this percentage
of users worldwide may be using a browser. In this case it causes
support for Android 4.3-4.4 to be dropped, which relate to Android
KitKat (released 2013).
This combination of changes means that all of the supported browsers in
our compatibility list support modern features including async,
for...of, classes, native Promises, and more which has a huge impact on
the ease of debugging code, and drastically reduces the minified file
size because a number of native Polyfills included by Babel are no
longer included.
Unfortunately the babel minify-mangle plugin seems to be abandoned and
in certain circumstances can be very buggy. The only safe options are to
disable it, or to switch to a different minification library.
Not minifying our javascript is not ideal, so this commit updates the
javascript tasks to use a rollup, combined with babel, and terser.
Babel still converts code from ES/UMD/AMD to AMD modules with the
relevant browser support, whilst terser minifies the code.
The rollup bundler handles tracking and creation of sourcemaps, and
supports better parallelisation of the tasks.
Since the upgrade to Node LTS/Gallium requires an upgrade to @babel/core
and eslint, which change the built files anyway, this seems like the
ideal time to make this change.
When a third-party AMD module is provided with an included name we must
replace it with a name that we are able to use.
The structure of an AMD module define function is:
[name], [dependencies], [callback]
String, Array, Function
Each of these is (strangely) optional.
We know that the name is the only String and will always be the first,
and we can use AST to remove a provided name before adding the
Moodle-specific name.
This should be a safe change and not lead to any changes in built code,
but will make it easier to include third-party code.
An additional logging line is also included to inform developers that a
change was made.
Before this change grunt tried to use the Linux version of files in
node_modules/.bin rather than the Windows version which is generated
by npm.
To avoid this issue we need to run the components directly.
- This tool is only available for admins
- Before using this tool the hosting admin will need to have NPM installed and be able to run grunt
- To create the docs pages for the library run "grunt componentlibrary"
- After the pages are created the Library is available in Site adminstration > Development > UI Component Library
This new task handles building of component library documentation,
including the markdown to HTML, an index of the generated content used
for searching, and the CSS for the component library.
Prior to this change the Grunt stylelint command was too greedy when
determining which files hsould be linted.
This change modifies the watch command to only watch relevant files and
subdirectories of each component directories. This means that unrelated
CSS and SCSS files are no longer watched for changes, and has the added
benefit of significantly increaseing the startup speed of grunt.
Without this patch applied the watch tasks were checking for matches in
the node_modules, and vendor directories.
Prior to this change all Grunt features were in a single Gruntfile.js
but this has become difficult to manage and maintain.
This commit moves the existing dependencies for component calculation
and babel moduel definition into a new .grunt directory, and
restructures the existing tasks in Gruntfile.js into separate task
configuration files.
This improves the maintainability of the Grunt build system and allows
for easier future expansion.
