Commit Graph

121 Commits

Author SHA1 Message Date
Stephen Compall
c24c17d595
Javascript library security updates (#15798)
Incorporates fixes for

- CVE-2022-3517
- CVE-2022-37599
- CVE-2022-37601

* update minimatch in root
* update minimatch in daml-extension
* update minimatch in typescript libraries
* update minimatch and loader-utils in navigator
2022-12-05 12:40:46 -05:00
Gary Verhaegen
e8e9f5dc36
fix gsg on node 18 (#15373)
CHANGELOG_BEGIN
CHANGELOG_END
2022-11-28 11:52:47 +01:00
fayi-da
a462277bf0
Remove yarn resolutions (#15259)
CHANGELOG_BEGIN
CHANGELOG_END
2022-10-19 16:52:56 +01:00
Stephen Compall
7a85900e0c
update parse-url from 6.0.5 to 8.1.0 (#15183)
- CVE-2022-2900
- CVE-2022-3224

CHANGELOG_BEGIN
CHANGELOG_END
2022-10-06 12:42:46 -04:00
Chun Lok Ling
dbebbeae44
Added interface id prefix without package id to choices popup (#14941)
* added interface id prefix without package id to choices popup

CHANGELOG_BEGIN
CHANGELOG_END

* strong prefix
* format
2022-09-06 10:52:25 +01:00
Chun Lok Ling
51ce902e6e
14796 front end change (#14811)
* added graphql resolve field

CHANGELOG_BEGIN
CHANGELOG_END

* render interface prefix; add interface in the route path; added graphql resolve field

* pass in interface id if the choice exercised via interface

* render interface choice in popup when click wrench icon
2022-08-25 10:42:31 +01:00
Stephen Compall
4462a0b873
remove unneeded yarn resolutions (#14714)
* regenerate yarn lock

CHANGELOG_BEGIN
CHANGELOG_END
2022-08-16 11:30:31 -04:00
Stephen Compall
5e0a475359
Address navigator frontend security advisories (#14583)
- CVE-2022-2216
- CVE-2022-25858
- CVE-2022-31129
- CVE-2022-0722
- CVE-2022-0624
- CVE-2022-25851
- CVE-2021-35065
- CVE-2022-2218
- CVE-2021-43138

CHANGELOG_BEGIN
CHANGELOG_END
2022-08-02 11:02:06 -04:00
Stefano Baghino
ec87d8dbb1
Address CVE-2022-24785 (#13549)
changelog_begin
changelog_end
2022-04-11 10:56:51 +02:00
Stefano Baghino
98a62622e8
Address open security advisories (#13377)
Address CVE-2022-24771
Address CVE-2022-24772
Address CVE-2022-24773

changelog_begin
changelog_end
2022-03-23 11:05:20 +01:00
Stefano Baghino
9fef07a02a
Address CVE-2021-44906 (#13376)
changelog_begin
changelog_end
2022-03-23 09:27:15 +00:00
Gary Verhaegen
dfa648f585
hunt down DAML better (#13195)
Process:

- `git ls-files -z | xargs -0 -n 100 sed -i --follow-symlinks 's/DAML/Daml/g'`
- `git add -p`
- `git restore -p`
- Check there is no unstaged change left.

To review:

- Check for false positives by carefully reviewing the diff in this PR.
- Check for false negatives with `git grep DAML`.
- Quicker check for fals positives:

```
git grep DAML | grep -v migration | grep -v DAML_
```

Fixes #13190

Note: This is the "second half" of #13191, which failed to cover all the
remaining DAMLs because of:

```
$ git ls-files | grep "'"
compiler/damlc/tests/daml-test-files/MangledScenario'.daml
```

CHANGELOG_BEGIN
CHANGELOG_END
2022-03-08 17:04:58 +01:00
Stefano Baghino
dc5f203323
Address CVE-2022-0144, resolve shelljs to 0.8.5 (#12927)
changelog_begin
changelog_end
2022-02-14 22:30:06 +00:00
Stefano Baghino
a49c321902
Add party identifier autocompletion to Navigator (#12923)
Fixes #12789

Adds a new query endpoint to Navigator's GraphQL backend that
lists all the parties registered by Navigator. The parties are
filtered on the server based on a query from the frontend and
served back. The frontend uses this to provide suggestion and
autocompletion features whenever a party identifier input is
required.

changelog_begin
[Navigator] Whenever you have to input a party identifier you
are now offered suggestions and the possibility to
autocomplete. See #12789.
changelog_end
2022-02-14 20:55:46 +00:00
dependabot[bot]
afef1a3827
Bump follow-redirects from 1.14.7 to 1.14.8 in /navigator/frontend (#12911)
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.14.7 to 1.14.8.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.14.7...v1.14.8)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-14 18:47:26 +00:00
Stefano Baghino
7252a66b2f
Wire contract identifier autocompletion in Navigator (#12916)
Navigator already had the possibility of autocompleting contract
identifiers, the only thing missing was to wire it in in full. This is
done mostly to inform how to address the more involved #12789.

changelog_begin
[Navigator] All input fields where a contract identifier can be passed
now provide the possibility of auto-completing based on the contracts
existing on the ledger.
changelog_end
2022-02-14 15:55:46 +00:00
Stefano Baghino
09a3eeab0c
Shorten contract and party identifiers in Navigator (#12913)
As we transition to Canton, we use a new format of contract and party
identifiers that can break the UI of Navigator here and there. In
order to prevent this, we use the same rules as Canton does to shorten
identifiers (basically, elide any hash longer than 12 characters).
Full identifiers are still shown as part of the tooltip.

Furthermore, a tooltip suggests that clicking on the shortened
identifier copies it in full length on the clipboard (which is indeed
what happens). There are a couple of possible improvements to this
interaction, which cannot be handled as part of this PR due to time
constraint:

- the visual cue suggesting that the identifier can be copied can be
improved by adding a clipboard icon besides the label
- there is no visual feedback from copying the identifier, ideally the
user should somehow see that the copying took place (e.g. by turning the
clipboard icon suggested in the point above into a checkmark for a
couple of seconds)

changelog_begin
[Navigator] Contract and party identifiers are shortened on the UI
but can be copied in full by clicking on their label.
changelog_end
2022-02-14 16:10:09 +01:00
Victor Peter Rouven Müller
c0c40bd10f
Add autoformatting to ts bindings & navigator frontend (#12693)
* Add autoformatting for the ts&tsx files (typescript effectively)

changelog_begin
changelog_end

* Format ts files

* Fix ts linter warnings
2022-02-11 11:44:52 +00:00
Adriaan Moors
46c32289c0
Navigator supports user management (#12187)
Add basic support for user management to navigator:
log in as a user, act/read as its primary party.

When user management is supported & enabled, you can
only log in as a user (and that user must have a
primary party, which is what you'll actually be
acting/reading as).

The above is the default behavior. It can be disabled
using a feature flag (`--feature-user-management`),
and you can also still specify parties explicitly 
in the config file.


CHANGELOG_BEGIN
Navigator supports user management by default. To disable,
use `--feature-user-management false` or specify parties 
explicitly in `daml.yaml`.
CHANGELOG_END



Co-authored-by: Robert Autenrieth <31539813+rautenrieth-da@users.noreply.github.com>
Co-authored-by: Stefano Baghino <43749967+stefanobaghino-da@users.noreply.github.com>
Co-authored-by: Victor Peter Rouven Müller <mueller.vpr@gmail.com>
2022-02-09 10:28:30 +01:00
Jennifer Whyte
7305a8c297
Color and typography edits (#12609)
CHANGELOG_BEGIN
CHANGELOG_END
2022-01-26 17:35:01 -05:00
Stefano Baghino
36f8d67c59
Upgrade css-loader to 5.2.7 (#12550)
changelog_begin
changelog_end

Fixes the transitive vulnerable dependency on `nanoid`.

Verified via `yarn audit`. Ran a quick manual test to check that
this did not break `navigator`.
2022-01-24 12:07:21 +00:00
Stefano Baghino
995c8bdfe3
Unpin the self-signed resolution (#12446)
Follow up to #12443 and #12457, removes the transitive vulnerable
dependency on `node-forge` 0.10.0.

changelog_begin
changelog_end
2022-01-18 15:15:25 +00:00
Stefano Baghino
69a8b6797e
Fix reported vulnerabilities (#12443)
changelog_begin
changelog_end

Bump resolved markdown-it version to 12.3.2 for modernizr

Bump webpack-dev-server to 4.3.7 to fix transitive issue reported on selfsigned 1.x

Bump marked to 4.0.10 to address reported vulnerability
2022-01-17 17:55:01 +00:00
dependabot[bot]
952a939620
Bump follow-redirects from 1.14.0 to 1.14.7 in /navigator/frontend (#12418)
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.14.0 to 1.14.7.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.14.0...v1.14.7)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-01-17 08:04:59 +00:00
Gary Verhaegen
ea55ea2d14
Further copyright updates (#12249)
Somewhat error-prone, so please review carefully.

Reasons we need this:

- Some file types are not properly handled by the script.
- The only exclusion mechanism we currently have (`NO_AUTO_COPYRIGHT`)
  is overly coarse.

CHANGELOG_BEGIN
CHANGELOG_END
2022-01-04 16:32:17 +01:00
Gary Verhaegen
d2e2c21684
update copyright headers (#12240)
New year, new copyright, new expected unknown issues with various files
that won't be covered by the script and/or will be but shouldn't change.

I'll do the details on Jan 1, but would appreciate this being
preapproved so I can actually get it merged by then.

CHANGELOG_BEGIN
CHANGELOG_END
2022-01-03 16:36:51 +00:00
Moritz Kiefer
df59f3fe8e
Fix Navigator dependabot alerts (#11044)
I used a selective override for strip-ansi because html-webpack-plugin
cannot handle 7.0.0 and I don’t want to downgrade it in other places
where we are already using 7.0.0.

changelog_begin
changelog_end
2021-09-28 08:07:56 +00:00
Moritz Kiefer
6bf45a344a
Upgrade Navigator to Webpack 5 (#11040)
* Upgrade Navigator to Webpack 5

changelog_begin
changelog_end

* Disable broken modernizr checks

changelog_begin
changelog_end

* drop unused dep

changelog_begin
changelog_end
2021-09-27 21:59:54 +02:00
Stefano Baghino
e36eb46f59
Resolve set-value to 4.0.1 and above (#11029)
Fixes security notice

changelog_begin
changelog_end
2021-09-27 11:21:36 +00:00
Moritz Kiefer
5f3f5824f2
Upgrade webpack-dev-server in Navigator (#11025)
Tested manually that it worked. It didn’t work before actually since
the `webpack serve` switch was needed even for the old version but now
it does.

Unfortunately this still doesn’t get rid of the dependency on setvalue.

changelog_begin
changelog_end
2021-09-27 08:14:41 +00:00
matevarga-da
1fc58d93f1
Navigator customviews highlight and choices button, apply custom theme on the login screen (#10859)
* Custom views menu highlighting and choices button fixes.

* Consider theme on the login screen

* Consider theme on the login screen

Originally reported here: https://discuss.daml.com/t/how-to-highlight-selected-custom-filter-button-in-navigator-how-to-use-the-choice-field-in-a-custom-view

changelog_begin
- [Navigator] The currently selected custom view is now highlighted on the sidebar
changelog_end

* Use page.state.id and defined user object.
2021-09-14 11:32:04 +02:00
Moritz Kiefer
654d2eee1b
Bump url-parse to address dependabot alerts (#10593)
changelog_begin
changelog_end
2021-08-17 11:03:10 +02:00
Moritz Kiefer
56059f32d4
Upgrade path-parse to 1.0.7 (#10587)
Mostly to get dependabot to shutup

changelog_begin
changelog_end
2021-08-16 16:39:45 +00:00
Moritz Kiefer
4affb053e9
Force newer version of glob-parent in Navigator (#10105)
This addresses a dependabot alert.

No nice way to do this unfortunately, it’s pulled in via transitive
deps which don’t have a version with less restrictive bounds.

I did test manually that Navigator still works (it’s a dev-time only
dependency).

changelog_begin
changelog_end
2021-06-24 14:04:38 +02:00
Victor Peter Rouven Müller
7375e28271
Force resolution for css what to 5.0.1 (#9925)
changelog_begin
changelog_end
2021-06-09 06:32:07 +00:00
Moritz Kiefer
b6a89a6948
Bump ws to address security advisory (#9844)
Tested manually that Navigator does not fall over with this.

changelog_begin
changelog_end
2021-05-31 10:38:23 +02:00
Moritz Kiefer
575bf04303
Address navigator security vulnerability (#9789)
changelog_begin
changelog_end
2021-05-26 10:50:32 +02:00
Moritz Kiefer
cae429237e
Upgrade rules-nodes to version 3.5.0 (#9635)
* Upgrade rules-nodes to version 3.4.2

No particularly strong reason for doing that. I just like staying up2date.

changelog_begin
changelog_end

* Patch Windows

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end

* .

changelog_begin
changelog_end
2021-05-25 16:04:39 +02:00
Moritz Kiefer
b082274885
Address vulnerabilities in Navigator (#9617)
Tested manually that everything still works.

changelog_begin
changelog_end
2021-05-07 17:12:41 +02:00
Moritz Kiefer
767e47fb94
Make occurence occur less often (#9258)
changelog_begin
changelog_end
2021-03-26 21:17:09 +01:00
Moritz Kiefer
8790bd7d75
Upgrade ssri to address security warning (#9249)
I tried fixing it properly without a resolution but that requires an
upgrade to webpack 5 which runs into issues since the modernizr loader
we use does not support webpack 5 and at that point I gave up. I did
test navigator manually with this change.

changelog_begin
changelog_end
2021-03-26 13:01:23 +01:00
Stefano Baghino
e33479af4c
Apply new Daml logo to Navigator (#9101)
Also removes mark.png, which was unused.

changelog_begin
[Navigator] New logo
changelog_end
2021-03-11 16:04:55 +00:00
Moritz Kiefer
642385a692
Upgrade elliptic dependency to address vulnerabilities (#9055)
* Upgrade elliptic dependency to address vulnerabilities

This PR bumps our already existing resolution on elliptic to address a
security issue.

I don’t believe in keeping deps at arbitrarily outdated versions so
this PR fully regenerates the yarn.lock files.

changelog_begin
changelog_end

* Apparently upgrading Navigator is bad

changelog_begin
changelog_end
2021-03-09 14:44:10 +01:00
Bernhard Elsner
cda93db944
Daml case and logo (#8433)
* Replace many occurrences of DAML with Daml

* Update docs logo

* A few more CLI occurrences

CHANGELOG_BEGIN
- Change DAML capitalization and docs logo
CHANGELOG_END

* Fix some over-eager replacements

* A few mor occurrences in md files

* Address comments in *.proto files

* Change case in comments and strings in .ts files

* Revert changes to frozen proto files

* Also revert LF 1.11

* Update get-daml.sh

* Update windows installer

* Include .py files

* Include comments in .daml files

* More instances in the assistant CLI

* some more help texts
2021-01-08 12:50:15 +00:00
Gary Verhaegen
427179ab27
fix (some) copyright headers (#8422)
This commit fixes a few copyright headers that have been missed in the
automatic update on Jan 1, as well as the generation code in the compat
workspace so it generates the right headers.

CHANGELOG_BEGIN
CHANGELOG_END
2021-01-07 11:48:59 +01:00
Gary Verhaegen
a925f0174c
update copyright notices for 2021 (#8257)
* update copyright notices for 2021

To be merged on 2021-01-01.

CHANGELOG_BEGIN
CHANGELOG_END

* patch-bazel-windows & da-ghc-lib
2021-01-01 19:49:51 +01:00
Moritz Kiefer
8d6f1c929b
Migrate Navigator from TSLint to ESLint (#8172)
* Switch config from tslint to eslint

changelog_begin
changelog_end

* Rename disable comments

changelog_begin
changelog_end

* Fix all the lints

changelog_begin
changelog_end
2020-12-04 17:02:13 +01:00
Moritz Kiefer
e0e317e05d
Avoid favicons-webpack-plugin in Navigator (#8159)
We really don’t need 5 different favicons here so just inline the same
one we use in create-daml-app and on our docs (32x32). This allows us
to get rid of tons of dependencies including a native dep on sharp.

changelog_begin
changelog_end
2020-12-03 18:15:56 +00:00
Moritz Kiefer
4cfb360da2
Bump remaining Navigator frontend deps (#8156)
This finally gets up to the point where almost all deps are on the
latest version (according to `yarn outdated`). The one exception is
webpack since at least some of our webpack loaders don’t work with
webpack 5 yet.

Another issue is that tslint is deprecated and should be replaced by
eslint. I’ll tackle that as a separate PR.

changelog_begin
changelog_end
2020-12-03 17:15:21 +00:00
Moritz Kiefer
92e4c1f6d4
Bump more navigator frontend deps (#8141)
changelog_begin
changelog_end
2020-12-03 15:58:43 +01:00