This is an automated email from the ASF dual-hosted git repository.
tbonelee pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git
The following commit(s) were added to refs/heads/master by this push:
new 7dd659ee63 [HOTFIX] Fix 3 high-severity npm audit vulnerabilities in
zeppelin-react
7dd659ee63 is described below
commit 7dd659ee633466caec6e36079dc478ef36a2873d
Author: YONGJAE LEE (이용재) <[email protected]>
AuthorDate: Wed Jul 22 00:03:39 2026 +0900
[HOTFIX] Fix 3 high-severity npm audit vulnerabilities in zeppelin-react
### What is this PR for?
The `npm-audit` CI job (`.github/workflows/frontend.yml`) is failing on
`master`
because `npm audit --audit-level=high` reports 3 high-severity advisories in
zeppelin-react's transitive dev-toolchain dependencies:
| Package | Advisory | Issue |
|---|---|---|
| `brace-expansion` |
[GHSA-3jxr-9vmj-r5cp](https://github.com/advisories/GHSA-3jxr-9vmj-r5cp) | DoS
via exponential-time `{}` expansion |
| `js-yaml` |
[GHSA-52cp-r559-cp3m](https://github.com/advisories/GHSA-52cp-r559-cp3m) |
Quadratic CPU on YAML merge-key chains |
| `shell-quote` |
[GHSA-395f-4hp3-45gv](https://github.com/advisories/GHSA-395f-4hp3-45gv) |
Quadratic-complexity DoS in `parse()` |
All three are non-breaking, in-range fixes applied via `npm audit fix`
(lockfile-only; `package.json` is untouched). Resolved versions:
`brace-expansion` 1.1.16 / 5.0.7, `js-yaml` 4.3.0, `shell-quote` 1.10.0.
### What type of PR is it?
Hotfix (CI)
### What is the Jira issue?
N/A — CI hotfix, no functional change.
### How should this be tested?
Verified locally under CI-matching Node 22.21.1 (`.nvmrc`) / npm 10.9.4:
- `cd zeppelin-web-angular/projects/zeppelin-react`
- `npm ci --ignore-scripts && npm audit --audit-level=high` → `found 0
vulnerabilities` (exit 0 — the exact npm-audit CI step)
- `npm test` → 13 passed
- `npm run lint` → no issues
### Screenshots (if appropriate)
N/A
### Questions:
- Does the licenses files need to update? No
- Is there breaking changes for older versions? No
- Does this needs documentation? No
Closes #5334 from voidmatcha/hotfix/react-npm-audit.
Signed-off-by: ChanHo Lee <[email protected]>
---
.../projects/zeppelin-react/package-lock.json | 42 +++++++++++-----------
1 file changed, 21 insertions(+), 21 deletions(-)
diff --git a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
index 6a209e6182..00c5813aec 100644
--- a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
+++ b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
@@ -509,9 +509,9 @@
"license": "MIT"
},
"node_modules/@eslint/config-array/node_modules/brace-expansion": {
- "version": "1.1.15",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz";,
- "integrity":
"sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+ "version": "1.1.16",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
+ "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -590,9 +590,9 @@
"license": "MIT"
},
"node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
- "version": "1.1.15",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz";,
- "integrity":
"sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+ "version": "1.1.16",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
+ "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3345,9 +3345,9 @@
"license": "ISC"
},
"node_modules/brace-expansion": {
- "version": "5.0.6",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz";,
- "integrity":
"sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+ "version": "5.0.7",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz";,
+ "integrity":
"sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -4729,9 +4729,9 @@
"license": "MIT"
},
"node_modules/eslint-plugin-react/node_modules/brace-expansion": {
- "version": "1.1.15",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz";,
- "integrity":
"sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+ "version": "1.1.16",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
+ "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -4800,9 +4800,9 @@
"license": "MIT"
},
"node_modules/eslint/node_modules/brace-expansion": {
- "version": "1.1.15",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz";,
- "integrity":
"sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+ "version": "1.1.16",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
+ "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -6462,9 +6462,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
- "version": "4.2.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz";,
- "integrity":
"sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz";,
+ "integrity":
"sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
"dev": true,
"funding": [
{
@@ -9435,9 +9435,9 @@
}
},
"node_modules/shell-quote": {
- "version": "1.8.4",
- "resolved":
"https://registry.npmjs.org/shell-quote/-/shell-quote-1.8.4.tgz";,
- "integrity":
"sha512-VsC6n6vz1ihYYyZZwX7YZSF5l5x36ca17OC+a69h94YqB7X6XLwf+5MOgynYir2SLFUbl8gIYvBo8K8RoNQ6bQ==",
+ "version": "1.10.0",
+ "resolved":
"https://registry.npmjs.org/shell-quote/-/shell-quote-1.10.0.tgz";,
+ "integrity":
"sha512-w1aiOKwKuRgtwAReIIj89puqg+I7GvX4IbLrvmhXbzQsj1+Zwi4VO3+fa6ZF91TWSjIxoEkKnMeHcLEODK5ZXA==",
"dev": true,
"license": "MIT",
"engines": {
