[full-ci] remove outdated and unused cldr dep from kpop in idp package

[kulmann]

Description

The idp ui uses kpop (opinionated react component library), which declares an outdated cldr version without even using it. Since that currently has a security issue, we're patching the idp ui to remove the cldr dependency from kpop entirely.

Asked upstream, if we can safely remove the dependency. Kopano-dev/kpop#40

Related Issue

• Works towards Update IDP and dependencies #7957

Motivation and Context

Security

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Technical debt
• Tests only (no source changes)

Checklist:

• Code changes
• Unit tests added
• Acceptance tests added
• Documentation ticket raised:

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[AlexAndBear]

Could you please add a comment or link this pr for now ?

[dschmidt]

Douglas Crockford:

I removed comments from JSON because I saw people were using them to hold parsing directives, a practice which would have destroyed interoperability. I know that the lack of comments makes some people sad, but it shouldn't.

Suppose you are using JSON to keep configuration files, which you would like to annotate. Go ahead and insert all the comments you like. Then pipe it through JSMin before handing it to your JSON parser.

TL;DR: no comments in json. Vscode and TS allow it, but it's non-standard and pnpm doesn't.

[kulmann]

That's in fact why I didn't add a comment :-)

[JammingBen]

LGTM. I restarted the pipeline, looked unrelated at a first glance.

[sonarcloud]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[rhafer]

@kulmann Hm, upstream completely removed the kpop dependency itself (See: libregraph/lico#5). Shouldn't we just do that as well? Especially as kpop is originally coming from kopano as well. In general it would be nice to stay in sync with https://github.com/libregraph/lico as much as possible.

[kulmann]

@kulmann Hm, upstream completely removed the kpop dependency itself (See: libregraph/lico#5). Shouldn't we just do that as well? Especially as kpop is originally coming from kopano as well. In general it would be nice to stay in sync with https://github.com/libregraph/lico as much as possible.

For a security patch the PR should be ok... I'm not in favour of the "busy work" to stay in sync with upstream lico, especially since it's supposed to go away. Could you post your comment again to this issue, so that we can continue discussing it? #7957