pawarprasad123 commented on code in PR #703:
URL: https://github.com/apache/atlas/pull/703#discussion_r3718758863
##########
dashboard/package.json:
##########
@@ -113,11 +113,9 @@
},
"overrides": {
"semver": "7.5.4",
- "minimatch": "9.0.7",
- "brace-expansion": "5.0.6",
"d3-color": "3.1.0",
"lodash": "4.18.1",
"lodash-es": "4.18.1",
- "js-yaml": "4.3.0"
+ "brace-expansion": "5.0.7"
Review Comment:
brace-expansion override still vulnerable (High priority)
PR sets "brace-expansion": "5.0.7", but npm audit still reports:
brace-expansion 4.0.0 - 5.0.8 → HIGH severity
GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
[email protected] is still flagged by npm audit (affected range is 4.0.0
- 5.0.8). Please bump to the first patched version (check npm audit fix output
or advisory GHSA pages) rather than stopping at 5.0.7.
##########
dashboard/package.json:
##########
@@ -113,11 +113,9 @@
},
"overrides": {
"semver": "7.5.4",
- "minimatch": "9.0.7",
- "brace-expansion": "5.0.6",
"d3-color": "3.1.0",
"lodash": "4.18.1",
"lodash-es": "4.18.1",
- "js-yaml": "4.3.0"
+ "brace-expansion": "5.0.7"
}
-}
+}
Review Comment:
Please attach npm audit output after applying this PR. Current result still
shows 7 vulnerabilities (2 high, 4 moderate, 1 low), not zero. Also consider
running npm run test:governance
The PR description states all 8 npm audit warnings were cleared. After
applying this patch locally, npm audit still reports 7 vulnerabilities,
including [email protected], postcss, and brace-expansion. For quill,
[GHSA-v3m3-f69x-jf25](https://github.com/advisories/GHSA-v3m3-f69x-jf25) lists
no patched version on npm — please update the description to note this as a
known/unresolved advisory rather than claiming it is fixed.
Missing newline at end of file. Please add trailing \n after the closing }
##########
dashboard/package.json:
##########
@@ -113,11 +113,9 @@
},
"overrides": {
"semver": "7.5.4",
Review Comment:
Please document why minimatch and js-yaml overrides were removed. Removing
js-yaml: 4.3.0 causes the lockfile to resolve [email protected] (dev-only via
babel-jest), which is a downgrade from the previously pinned 4.x. Was this
intentional? If overrides are no longer needed, please confirm via npm ls
js-yaml and note it in the PR description.
Please either keep "js-yaml": "4.3.0" in overrides, or explain why 3.15.0
is acceptable and verify it does not reintroduce known CVEs.
Removing the minimatch: 9.0.7 override bumps transitive minimatch to 10.2.5.
Please confirm this was tested with npm test and npm run lint (glob/minimatch
behavior changes can affect test file matching). Consider keeping an explicit
override if 10.x is required for security.
##########
dashboard/package-lock.json:
##########
@@ -9486,68 +10967,26 @@
"node": ">=8"
}
},
- "node_modules/pkg-dir/node_modules/find-up": {
- "version": "4.1.0",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "locate-path": "^5.0.0",
- "path-exists": "^4.0.0"
- },
- "engines": {
- "node": ">=8"
- }
- },
- "node_modules/pkg-dir/node_modules/locate-path": {
- "version": "5.0.0",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "p-locate": "^4.1.0"
- },
- "engines": {
- "node": ">=8"
- }
- },
- "node_modules/pkg-dir/node_modules/p-limit": {
- "version": "2.3.0",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "p-try": "^2.0.0"
- },
- "engines": {
- "node": ">=6"
- },
- "funding": {
- "url": "https://github.com/sponsors/sindresorhus";
- }
- },
- "node_modules/pkg-dir/node_modules/p-locate": {
- "version": "4.1.0",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "p-limit": "^2.2.0"
- },
- "engines": {
- "node": ">=8"
- }
- },
"node_modules/platform": {
"version": "1.3.4",
+ "resolved": "https://registry.npmjs.org/platform/-/platform-1.3.4.tgz";,
+ "integrity":
"sha512-iPnLzoBruVgswLtQ06HuYW4JUYW+SupPyrzZnhVRPZuh9NDWojJYpQqR2Ro43XpUlh46l8ygbnWKVHO270XATg==",
"license": "MIT"
},
"node_modules/possible-typed-array-names": {
"version": "1.1.0",
+ "resolved":
"https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz";,
+ "integrity":
"sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">= 0.4"
}
},
"node_modules/postcss": {
- "version": "8.5.3",
+ "version": "8.5.21",
Review Comment:
postcss was bumped to 8.5.21, but npm audit still flags <=8.5.22
([GHSA-fxqj-rqcc-2cmp](https://github.com/advisories/GHSA-fxqj-rqcc-2cmp)).
Please bump to >=8.5.23 (or latest 8.5.x patch) to fully remediate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
