chore: Replace osmtogeojson #11438
chore: Replace osmtogeojson #11438
Conversation
We already use the `nginx:stable` tag, so `node:lts` does sound sensible.
github-actions
bot
added
📖 Knowledge Panels
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #11438 +/- ##
==========================================
+ Coverage 49.71% 49.85% +0.14%
==========================================
Files 82 83 +1
Lines 22896 22964 +68
Branches 5492 5501 +9
==========================================
+ Hits 11383 11449 +66
+ Misses 10124 10121 -3
- Partials 1389 1394 +5 ☔ View full report in Codecov by Sentry. |
| /*global L */ | ||
| /*exported displayMap*/ | ||
| import * as L from './leaflet-src.esm.js'; | ||
| import { MarkerClusterGroup } from './leaflet.markercluster.js'; |
There was a problem hiding this comment.
I tried to test it locally, but I'm getting an error when displaying search results on a map:
display-map.js:22 Uncaught SyntaxError: The requested module './leaflet.markercluster.js' does not provide an export named 'MarkerClusterGroup' (at display-map.js:22:10)
There was a problem hiding this comment.
PR Overview
This PR replaces the deprecated and vulnerable osmtogeojson module with a native GeoJSON API and updates the affected JavaScript files to use ES modules.
- Removed osmtogeojson dependency and updated code to use native fetch and ES module imports.
- Updated both display-tag.js and display-map.js to use ES modules and improved code structure.
- Adjusted gulpfile.ts to remove the vulnerable module and include the correct Leaflet ES module file.
Reviewed Changes
| File | Description |
|---|---|
| html/js/display-tag.js | Rewritten to use async/await and ES modules for fetching and processing GeoJSON data. |
| gulpfile.ts | Removed osmtogeojson and updated to reference leaflet-src.esm.js. |
| html/js/display-map.js | Converted to ES modules and updated MarkerClusterGroup import and usage. |
Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.
Co-authored-by: Copilot <[email protected]>
|
Replaces npm module
osmtogeojson, which requires a vulnerable version of an XML parser, and is unmaintained, with an API that returns GeoJSON natively.Additionally rewrites
display-tag.jsanddisplay-map.jsfiles to use ES modules, which are now well supported by browser, to reduce the usage of/* global */to avoid eslint complaining about an error.Fixes https://github.com/openfoodfacts/openfoodfacts-server/security/dependabot/32 by removing the transitive dependency.