StackStorm · arm4b · Nov 29, 2023 · Oct 20, 2023 · Sep 28, 2023 · Sep 28, 2023
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -7,12 +7,14 @@
 version: 2
 jobs:
   build:
-    machine: true
+    machine:
+      # pin image to older version as "ubuntu-2204:2023.10.1" breaks on "nvm" step
+      image: ubuntu-2204:2023.04.2
     environment:
       DEPLOY_PACKAGES: 1
       DEB: bionic focal
       RPM: el7 el8
-      ST2_VERSION: "3.6dev"
+      ST2_VERSION: "3.8"
       ST2_HOST: localhost
       ST2_PROTOCOL: http
       ST2_USERNAME: st2admin
@@ -33,8 +35,8 @@ jobs:
             set +e
             export NVM_DIR="/opt/circleci/.nvm"
             [ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
-            nvm install 14.20.1
-            nvm alias default v14.20.1
+            nvm install 20.8.1
+            nvm alias default v20.8.1
 
             # Each step uses the same `$BASH_ENV`, so need to modify it
             echo 'export NVM_DIR="/opt/circleci/.nvm"' >> $BASH_ENV
@@ -57,18 +59,18 @@ jobs:
             sudo apt-get update
             sudo apt-get install rpm jq devscripts debhelper
             gem install package_cloud
-            nvm use 14.20.1
-            npm install --global lerna yarn
+            nvm use 20.8.1
+            npm install --global lerna@6.0.0 yarn
       - run:
           name: Install package dependencies
           command: |
-            nvm use 14.20.1
+            nvm use 20.8.1
             lerna bootstrap
 
       - run:
           name: Run unit tests
           command: |
-            nvm use 14.20.1
+            nvm use 20.8.1
             npm run test-unit
 
       - run:
@@ -127,13 +129,13 @@ jobs:
       - run:
           name: Make deb packages
           command: |
-            nvm use 14.20.1
+            nvm use 20.8.1
             make deb
             echo $DEB | tr ' ' '\n' | xargs -I{} cp -vr ../st2web_*.{deb,changes} ~/artifacts/{}
       - run:
           name: Make RPM packages
           command: |
-            nvm use 14.20.1
+            nvm use 20.8.1
             make rpm
             echo $RPM | tr ' ' '\n' | xargs -I{} cp -vr ../st2web-*.rpm ~/artifacts/{}
       - store_artifacts:
@@ -148,7 +150,7 @@ jobs:
             - el8
   deploy:
     docker:
-      - image: ruby:2.6.3
+      - image: ruby:2.7
     environment:
       ARTIFACTS: /home/circleci/artifacts
       DISTROS: bionic focal el7 el8

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -4,6 +4,25 @@ Changelog
 in development
 --------------
 
+Changed
+~~~~~~~
+* Updated various dependencies (security). #1009, #1020
+
+  Contributed by @enykeev
+
+* Updated NodeJS to v20 current (security). #1010
+
+  Contributed by @enykeev
+
+Fixed
+~~~~~
+* Fixed CircleCI tests by pinning lerna@6.0.0. #1008
+
+  Contributed by @guzzijones
+
+
+st2 v3.8.0
+------
 
 Added
 ~~~~~
@@ -30,7 +49,6 @@ Changed
 
   Reported by @cded from @Bitovi
 
-
 Fixed
 ~~~~~
 * Fixed CircleCI tests
@@ -44,7 +62,3 @@ Fixed
 * Escaped text in notifications. #990
 
   Contributed by @cded from @Bitovi
-
-
-v2.4.3
-------
diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:14.20.1
+FROM node:20.8.1
 
 # Create app directory
 WORKDIR /opt/stackstorm/static/webui/st2web

diff --git a/Dockerfile-dev b/Dockerfile-dev
@@ -1,4 +1,4 @@
-FROM node:14.20.1
+FROM node:20.8.1
 
 # Create app directory
 WORKDIR /opt/stackstorm/static/webui/st2web

diff --git a/Dockerfile-nginx b/Dockerfile-nginx
@@ -1,4 +1,4 @@
-FROM node:14.20.1 as build
+FROM node:20.8.1 as build
 
 # Create app directory
 WORKDIR /opt/stackstorm/static/webui/st2web

diff --git a/Dockerfile-nginx-dev b/Dockerfile-nginx-dev
@@ -1,4 +1,4 @@
-FROM node:14.20.1 as build
+FROM node:20.8.1 as build
 
 # Create app directory
 WORKDIR /opt/stackstorm/static/webui/st2web

diff --git a/Makefile b/Makefile
@@ -12,7 +12,7 @@ all: build
 # yarn now included in later node images
 npm-install:
 	echo "npm install"
-	npm install -g lerna
+	npm install -g lerna@6.0.0
 
 lerna:
 	echo "lerna"

diff --git a/README.md b/README.md
@@ -12,19 +12,18 @@ Quick start
 First of all, you need to make sure you have `node` and `npm` packages installed. Currently, we consider Node v14.x.x to be our stable.
 
 ```shell
-$ n 14
-
-install : node-v14.17.0
-  mkdir : /usr/local/n/versions/node/14.17.0
-  fetch : https://nodejs.org/dist/v14.17.0/node-v14.17.0-darwin-x64.tar.gz
-######################################################################## 100.0%
-installed : v14.17.0
+$ n 20
+  installing : node-v20.8.1
+       mkdir : /home/enykeev/n/n/versions/node/20.8.1
+       fetch : https://nodejs.org/dist/v20.8.1/node-v20.8.1-linux-x64.tar.xz
+     copying : node/20.8.1
+   installed : v20.8.1 (with npm 10.1.0)
 
 $ node -v
-v14.17.0
+v20.8.1
 
 $ npm -v
-6.14.13
+10.1.0
 ```
 
 then you need to globally install `gulp`, `lerna` and `yarn`

diff --git a/apps/st2-workflows/package.json b/apps/st2-workflows/package.json
@@ -63,7 +63,7 @@
     "gulp-uglify-es": "^1.0.4",
     "insert-css": "^2.0.0",
     "lodash": "^4.17.21",
-    "moment": "^2.18.1",
+    "moment": "^2.29.4",
     "prop-types": "^15.6.0",
     "react": "^16.8.4",
     "react-dom": "^16.8.4",
@@ -96,7 +96,7 @@
     "ignore-styles": "^5.0.1",
     "lerna": "^3.4.3",
     "less": "^3.9.0",
-    "postcss": "^7.0.14",
+    "postcss": "^8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0",

diff --git a/modules/st2-api/api.js b/modules/st2-api/api.js
@@ -97,8 +97,6 @@ export class API {
             'Authorization': `Basic ${toBase64(`${username}:${password}`)}`,
             'content-type': 'application/json',
           },
-          // You need to define data field for axios to set content-type header
-          data: null,
         });
 
         if (res.status !== 201) {

diff --git a/modules/st2-auto-form/package.json b/modules/st2-auto-form/package.json
@@ -57,7 +57,7 @@
     "prop-types": "15.7.2",
     "react": "16.8.6",
     "react-dom": "16.8.6",
-    "react-textarea-autosize": "5.2.1",
+    "react-textarea-autosize": "7.1.2",
     "validator": "^13.0.0"
   },
   "devDependencies": {

diff --git a/modules/st2-style/package.json b/modules/st2-style/package.json
@@ -48,7 +48,7 @@
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "normalize.css": "8.0.1",
     "babelify": "10.0.0",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0"

diff --git a/modules/st2flow-canvas/package.json b/modules/st2flow-canvas/package.json
@@ -53,7 +53,7 @@
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "babelify": "10.0.0",
     "classnames": "^2.2.6",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-color-mod-function": "^3.0.3",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",

diff --git a/modules/st2flow-details/package.json b/modules/st2flow-details/package.json
@@ -53,7 +53,7 @@
   "devDependencies": {
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "babelify": "10.0.0",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0"

diff --git a/modules/st2flow-editor/package.json b/modules/st2flow-editor/package.json
@@ -52,7 +52,7 @@
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "babelify": "10.0.0",
     "classnames": "^2.2.6",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0"

diff --git a/modules/st2flow-header/package.json b/modules/st2flow-header/package.json
@@ -51,7 +51,7 @@
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "babelify": "10.0.0",
     "classnames": "^2.2.6",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0"

diff --git a/modules/st2flow-palette/package.json b/modules/st2flow-palette/package.json
@@ -50,7 +50,7 @@
     "@stackstorm/browserify-postcss": "0.3.4-patch.5",
     "babelify": "10.0.0",
     "classnames": "^2.2.6",
-    "postcss": "7.0.14",
+    "postcss": "8.4.31",
     "postcss-import": "12.0.1",
     "postcss-nested": "4.1.2",
     "postcss-preset-env": "6.6.0"

diff --git a/package.json b/package.json
@@ -19,8 +19,8 @@
   },
   "repository": "stackstorm/st2web",
   "engines": {
-    "node": "14.20.1",
-    "npm": "6.14.12"
+    "node": "20.8.1",
+    "npm": "10.1.0"
   },
   "browserify": {
     "transform": [
@@ -75,11 +75,10 @@
     "js-yaml": "^3.13.1",
     "kind-of": "^6.0.3",
     "lodash": "4.17.21",
-    "lodash.template": "^4.5.0",
     "minimatch": "^3.0.4",
     "mixin-deep": "^1.3.2",
-    "moment": "2.24.0",
-    "node": "14.20.1",
+    "moment": "2.29.4",
+    "node": "20.8.1",
     "node-uuid": "^1.4.8",
     "open": "^8.4.0",
     "qs": "^6.10.2",
@@ -106,5 +105,8 @@
     "ignore-styles": "5.0.1",
     "insert-css": "2.0.0",
     "zombie": "5.0.8"
+  },
+  "resolutions": {
+    "open": "^8.4.0"
   }
 }
diff --git a/tasks/package.json b/tasks/package.json
@@ -41,7 +41,6 @@
     "chalk": "2.4.2",
     "css-extract": "1.3.1",
     "event-stream": "4.0.1",
-    "express": "4.16.4",
     "fancy-log": "1.3.3",
     "fontello-update": "0.6.5",
     "git-rev-sync": "1.12.0",

diff --git a/tasks/serve.js b/tasks/serve.js
@@ -34,15 +34,15 @@ gulp.task('serve', () => {
       https: true,
       proxies: [{
         source: '/api',
-        target: `https://${st2host}/api`,
+        target: `${process.env.ST2_PROTOCOL || 'https'}://${st2host}/api`,
         options,
       }, {
         source: '/auth',
-        target: `https://${st2host}/auth`,
+        target: `${process.env.ST2_PROTOCOL || 'https'}://${st2host}/auth`,
         options,
       }, {
         source: '/stream',
-        target: `https://${st2host}/stream`,
+        target: `${process.env.ST2_PROTOCOL || 'https'}://${st2host}/stream`,
         options,
       }],
     }));