Update JavaScript dependencies (#329)

* Update less to version 4.2.2

* Update po2json to 1.0.0-beta-3 to fix CVE with dependency

* Update jupyterlab/apputils and fix peer dependencies

* Fix html-css-sanitizer-minified.js not found

* Fix rjsf/utils is incompatible with Node 12

* Add npm build step before running tests

* Bump CasperJS version

* Update yarn and pip caching

* Bump PhantomJS version

* Fix incomplete build process on CI

* Revert jupyterlab/apputils to v3.6

* Pin yarn to classic version only

Author: danyeaw

.github/workflows/js.yml

@@ -1,4 +1,4 @@
-name: Linux JS Tests
+name: JavaScript Tests
 
 on:
   push:
@@ -33,27 +33,36 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
-          node-version: '12.x'
+          node-version: '16.x'
 
-      - name: Cache node modules
+      - name: get yarn cache directory path
+        id: yarn-cache-dir-path
+        run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache yarn
         uses: actions/cache@v4
-        env:
-          cache-name: cache-node-modules
+        id: yarn-cache
         with:
-          # npm cache files are stored in `~/.npm` on Linux/macOS
-          path: ~/.npm
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/package-lock.json') }}
+          path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+          key: ${{ runner.os }}-yarn-${{ hashfiles('**/yarn.lock') }}
           restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-
-            ${{ runner.os }}-build-
-            ${{ runner.os }}-
+            ${{ runner.os }}-yarn-
 
       - name: Cache pip on Linux
         uses: actions/cache@v4
         if: startsWith(runner.os, 'Linux')
         with:
           path: ~/.cache/pip
-          key: ${{ runner.os }}-pip-${{ env.python-version }}-${{ hashFiles('pyproject.toml') }}
+          key: ${{ runner.os }}-pip-${{ env.python-version }}-${{ hashfiles('pyproject.toml') }}
+          restore-keys: |
+            ${{ runner.os }}-pip-${{ env.python-version }}
+
+      - name: Cache pip on macOS
+        uses: actions/cache@v4
+        if: startsWith(runner.os, 'macOS')
+        with:
+          path: ~/Library/Caches/pip
+          key: ${{ runner.os }}-pip-${{ env.python-version }}-${{ hashfiles('pyproject.toml') }}
           restore-keys: |
             ${{ runner.os }}-pip-${{ env.python-version }}
 
@@ -65,8 +74,8 @@ jobs:
         run: |
           pip install --upgrade pip
           pip install --upgrade setuptools wheel
-          yarn install
-          npm install -g [email protected].3 [email protected].7
+          npm run build
+          npm install -g [email protected].4 [email protected].16
           pip install .[test]
 
       - name: Run Tests

.github/workflows/playwright.yml

@@ -30,11 +30,11 @@ jobs:
     - name: Set up Node
       uses: actions/setup-node@v4
       with:
-        node-version: '12.x'
+        node-version: '16.x'
 
-    - name: Install JS
+    - name: Install and build JS
       run: |
-        yarn install
+        npm run build
 
     - name: Install Python dependencies
       run: |

CONTRIBUTING.rst

@@ -27,15 +27,15 @@ Installing Node.js and npm
 Building the NbClassic from its GitHub source code requires some tools to
 create and minify JavaScript components and the CSS,
 specifically Node.js and Node's package manager, ``npm``.
-It should be node version ≥ 6.0.
+It should be node version ≥ 16.0. We also use Yarn (classic) version 1.x.
 
 If you use ``conda``, you can get them with::
 
-    conda install -c conda-forge nodejs
+    conda install -c conda-forge nodejs=16 yarn=1
 
 If you use `Homebrew <https://brew.sh/>`_ on Mac OS X::
 
-    brew install node
+    brew install node yarn
 
 Installation on Linux may vary, but be aware that the `nodejs` or `npm` packages
 included in the system package repository may be too old to work properly.
@@ -181,6 +181,10 @@ installed::
 
     npm install -g casperjs phantomjs-prebuilt
 
+Re-build the JavaScript prior to running tests::
+
+    npm run build
+
 Then, to run the JavaScript tests::
 
     python -m nbclassic.jstest [group]

package.json

@@ -39,17 +39,23 @@
   "devDependencies": {
     "@babel/core": "^7.15.0",
     "@babel/preset-env": "^7.15.0",
-    "@jupyterlab/apputils": "^3.1.3",
+    "@jupyterlab/apputils": "^3.6.1",
     "babel-loader": "^8.2.2",
     "babel-polyfill": "^6.26.0",
-    "bower": "^1.8.8",
-    "less": "~2",
+    "commander": "^6.0.0",
+    "gettext-parser": "2.0.0",
+    "gettext-to-messageformat": "0.3.1",
+    "less": "^4.2.2",
     "onchange": "^6.0.0",
-    "po2json": "^0.4.5",
+    "po2json": "1.0.0-beta-3",
     "requirejs": "^2.3.6",
     "webpack": "^5.46.0",
     "webpack-cli": "^4.7.2"
   },
+  "devDependenciesNotes": {
+    "@jupyterlab/apputils": "Restricted to 3.6.x because v4.x changes sanitizer API breaking Markdown cells",
+    "pos2json": "Using a beta 1.0.0 version because previous version have security problems, and no 1.0.0 release"
+  },
   "dependencies": {
     "@bower_components/MathJax": "mathjax/MathJax#^2.7.4",
     "@bower_components/backbone": "jashkenas/backbone#~1.6.0",
@@ -58,10 +64,10 @@
     "@bower_components/codemirror": "components/codemirror#5.58.2+components1",
     "@bower_components/es6-promise": "components/es6-promise#~1.0",
     "@bower_components/font-awesome": "components/font-awesome#~4.7.0",
-    "@bower_components/google-caja": "github:minrk/google-caja-bower#5669",
+    "@bower_components/google-caja": "https://github.com/minrk/google-caja-bower/archive/refs/tags/5669.0.0.tar.gz",
     "@bower_components/jed": "SlexAxton/Jed#~1.1.1",
     "@bower_components/jquery": "components/jquery#~3.7.1",
-    "@bower_components/jquery-typeahead": "running-coder/jquery-typeahead#~2.10.7",
+    "@bower_components/jquery-typeahead": "running-coder/jquery-typeahead#~2.11.1",
     "@bower_components/jquery-ui": "jquery/jquery-ui#~1.13.3",
     "@bower_components/marked": "chjj/marked#~4.0.10",
     "@bower_components/moment": "moment/moment#~2.29.4",
@@ -73,6 +79,7 @@
     "@bower_components/underscore": "jashkenas/underscore#~1.13.7"
   },
   "engines": {
-    "yarn": ">= 1.0.0"
+    "yarn": "^1.22.22",
+    "node": ">=16"
   }
 }