FrankChen021 opened a new pull request, #19815: URL: https://github.com/apache/druid/pull/19815
## Summary - upgrades the direct runtime dependencies ECharts to 6.1.0 and UUID to 11.1.1 - upgrades PostCSS and webpack to patched releases and pins patched transitive versions for Babel, `@tootallnate/once`, `brace-expansion`, `fast-uri`, `flatted`, `js-yaml`, `minimatch`, `picomatch`, and `yaml` - adds patched AJV 8 at the root so webpack's schema tooling resolves its expected major while AJV 6 consumers remain nested - updates the webpack `global` shim to `globalThis.global`, preserving React Ace's assign/delete SSR behavior under the newer webpack optimizer - regenerates the web-console third-party license inventory ## Dependabot coverage This lockfile removes vulnerable versions for all 28 currently open alerts associated with `web-console/package-lock.json`: - #743, #742, #733, #732, #713, #712, #704, #702 - #692, #690, #689, #666, #638, #636, #622, #618 - #601, #548, #546, #541, #538, #516, #513, #511 - #486, #485, #459, #457 Every occurrence of each affected package in the resulting lockfile was checked against the alert's vulnerable version range; all 28 checks are clear. ## Compatibility impact ECharts moves from major 5 to major 6 and UUID moves from major 7 to major 11. Existing console imports and type usage compile without source changes, and the complete unit suite passes. The webpack shim adjustment is required for a minified production build with webpack 5.104+. ## Validation - `npm ci` - `npm run test-unit` — 158 suites, 785 tests, and 247 snapshots passed - `npm run compile -- --force` - `npm run check-licenses` - `git diff --check` - programmatic verification of all 28 GitHub alert ranges against every matching lockfile occurrence ## Caveat A newer npm advisory for `brace-expansion` now marks all releases through 5.0.7 vulnerable. Fixing that separate advisory would require forcing legacy consumers across multiple major versions to 5.0.8+, which is outside the 28-alert GitHub batch and is not done here without upstream compatibility work. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
