Release contacts 1.5.6

[phil-davis]

Because of issue #708 fixed by PR #709

Someone needs to check if the problem is just related to recent changes in core master, and thus a release is only needed along with core 10.7.1. Or if the release needs to/can work with older ownCloud core 10.7, 10.6...

[jnweiger]

Is a new release also needed to work with 10.8.0 ?

[phil-davis]

I am not sure. Someone needs to check if the current marketplace-released/bundled contacts app has UI working nicely with a core 10.8.0 system. (CI is not going to tell us that, because various JS libraries have been updated in PR #709 in master of this repo)

If we decide to do a new release, then we need to either:

1. set the core min version to 10.8.0, or;
2. manually verify that the latest contacts app code works correctly on older core 10.* versions (info.xml currently has owncloud min-version="10.2" so we would have to decide how many version back to test, and set min-version appropriately)

[jnweiger]

Issues seen while testing

"UI working nicely" is not how I would phrase it. Let's say "almost acceptably" :-)

• [QA] white text on light green background is hard to read #718
• [QA] notes input field can be dragged "underneath" items in second column #719
• [QA] Upload button silently does nothing #720

Same with server 10.7.0 -- apart from that, contacts works "fine" for me on 10.8.0 RC1 !

Security issues seen

• https://github.com/owncloud/contacts/security/dependabot 1 Crit, 0 High

[jnweiger]

Release not done by BTR team. removed from Board.

[phil-davis]

@DeepDiver1975 did this release https://github.com/owncloud/contacts/releases/tag/v1.5.4

Are you the one who does releases of contacts? Or?

[jnweiger]

We'll do a release this week, it seems...

Dependabots has onen critical issue:

• https://github.com/owncloud/contacts/security/dependabot/7

The build reports several security issues, and deprecated dependencies:

found 37 vulnerabilities (2 low, 15 moderate, 11 high, 9 critical)
  run `npm audit fix` to fix them, or `npm audit` for details

> npm install && npm update && node_modules/bower/bin/bower install && node_modules/bower/bin/bower update

npm WARN deprecated codecov@3.8.3: https://about.codecov.io/blog/codecov-uploader-deprecation-plan/
npm WARN deprecated argv@0.0.2: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated wreck@6.3.0: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5
npm WARN deprecated istanbul@0.4.5: This module is no longer maintained, try this instead:
npm WARN deprecated   npm i nyc
npm WARN deprecated Visit https://istanbul.js.org/integrations for other alternatives.
npm WARN deprecated formatio@1.1.1: This package is unmaintained. Use @sinonjs/formatio instead
npm WARN deprecated samsam@1.1.2: This package has been deprecated in favour of @sinonjs/samsam
npm WARN deprecated mkdirp@0.5.1: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated boom@2.10.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated hoek@2.16.3: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
npm WARN deprecated log4js@4.5.1: 4.x is no longer supported. Please upgrade to 6.x or higher.
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated stable@0.1.8: Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
npm WARN deprecated samsam@1.1.3: This package has been deprecated in favour of @sinonjs/samsam
npm WARN deprecated request@2.88.0: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated date-format@2.1.0: 2.x is no longer supported. Please upgrade to 4.x or higher.
npm WARN deprecated streamroller@1.0.6: 1.x is no longer supported. Please upgrade to 3.x or higher.
npm WARN deprecated fsevents@1.2.13: The v1 package contains DANGEROUS / INSECURE binaries. Upgrade to safe fsevents v2
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.