Brijesh619 opened a new pull request, #703: URL: https://github.com/apache/atlas/pull/703
## What changes were proposed in this pull request? This PR resolves [ATLAS-5348](https://issues.apache.org/jira/browse/ATLAS-5348) by upgrading several outdated frontend transitive dependencies in the Atlas React UI (`/dashboard`). Currently, running `npm audit` on the React UI flags 8 outdated transitive dependencies. This patch safely updates the `package-lock.json` (via `npm audit fix`) to bump these packages and resolve the following warnings: - **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment - **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping - **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped multipart field names (High Severity) - **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and ReDoS vulnerability (High Severity) - **postcss (<8.5.10):** XSS via Unescaped `</style>` in CSS Stringify Output (Moderate Severity) - **quill (=2.0.3):** XSS via HTML export feature - **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory exhaustion DoS (High Severity) - **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML collections (Moderate Severity) ## How was this patch tested? - **Manual Verification:** Ran `npm audit` locally in the `/dashboard` directory to verify that all 8 security warnings have been successfully cleared. - **Build Test:** Ran `npm run build` to ensure the React UI bundles successfully without any regressions from the bumped transitive dependencies. - **Runtime Test:** Started the local dev server and verified the UI loads and functions as expected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
