Update Nightwatch to 2.4.1

Drupal 10 should be on Nightwatch 2.1.4: https://git.drupalcode.org/project/drupal/-/blob/10.0.x/core/yarn.lock#L... so I'm not sure where did the Nightwatch 1.7.13 on 10.x come from. Either way we should update to the latest version.

v2.3.4 was released last week

Here's re-roll just using yarn upgrade nightwatch@^2.3.9

Let's try upgrading the JS chromedriver at the same time, now that the DrupalCI chrome container is also updated.

Hi folks,

I'm not sure if this is the right place to post my doubt.

On a client's project we're addressing the CVE-2022-36067 vulnerability report, that says:

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Found that vm2 is a dependency of nightwatch and that is in 3.9.9 version in drupal 9.5.x

This isn't installed on the client's server, but they get the warning. So, I've put together the following commands to generate a patch that came out with the vm2 3.9.11.

git clone https://git.drupalcode.org/project/drupal.git
cd drupal
git checkout 9.5.x
yarn upgrade nightwatch
yarn vendor-update
git diff > update-nightwatch.patch

How can I test this patch and figure out if it isn't blow out the entire project?

Removed some commented code from #17

latest release is 2.4.1 now :p https://github.com/nightwatchjs/nightwatch/releases/tag/v2.4.1

looks good enough to make this update in any case. We can always do the other update later

The only nitpick

+++ b/core/yarn.lock
@@ -1430,16 +1448,17 @@ chrome-trace-event@^1.0.2:
-chromedriver@^98.0.1:
-  version "98.0.1"
...
+chromedriver@^106:
+  version "106.0.1"

IIRC Drupal-CI went to 107 already

@andypost the version of Chromedriver in yarn.lock doesn't really matter, it is only used when running Nightwatch locally *and* an environment variable is set to use it; I suggested removing it in #3317879: Remove Chromedriver as a JavaScript dependency

Updated IS to reflect correct version number.

After patch #18 i got deprecation messages from nightwatch
New patch resolve some of them

#23 is unfortunately no longer passing tests. It also seems like a pretty drastic change compared to #18 which was RTBC'd? 🤔

Personally I would prefer to commit #18 which passed tests, and then solve any deprecations separately.

#25++

Let's do that.

⚠️#18 is RTBC, not #23. Let's create a follow-up to address deprecations.

Committed/pushed to 10.1.x and cherry-picked to 10.0.x, thanks!

Let's open a new issue to address #23.

Filed follow-up #3318301: Fix deprecations of Nightwatch

btw it could be a cause of random failures of JS tests as the message is thrown few times per nightwatch tests, maybe it needs to fix something at infra side

We are seeing D10 contrib test runs end with gray "build successful" instead of green "pass" which we get at D9. The modules do not have any nighwatch.js tests and the only difference in the log is that on D9 runs this was marked as a warning, but in D10 it gives an error. Here's a visual comparison of the log:

The above was from Display Suite https://www.drupal.org/node/607826/qa

If this has been caused by the upgrade to nightwatch 2.4.1 then maybe we need to document this somewhere. Also help other contrib maintainers who do not have any nightwatch tests to explain how to skip the nightwatch section. I have done this by removing 'nightwatch.js' in drupalci.yml but many contrib projects are just using the default drupalci.yml (ie they do not have their own to modify)

FWIW, I saw this starting to happen yesterday, while working on DS and Field Group, while branch tests where fine 3 days ago, and I wasn't really uploading/committing funky patches :) Adding a drupalci.yml file made it all green again (cf #3318535: Create a drupalci.yml file and #3318536: Create a drupalci.yml file)

@jonathan1055 thanks for the pointers!

This is also being discussed on Slack in the #drupal-infrastructure channel
https://app.slack.com/client/T06GX3JTS/C51GNJG91/thread/C51GNJG91-166730...

Contrib tests should no longer error out with 'Build successful' on DrupalCI. See #3318586: Fix DrupalCI handling of Nightwatch exit codes after 2.4.1 update