[
https://issues.apache.org/jira/browse/ATLAS-5348?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18102072#comment-18102072
]
Brijesh Bhalala commented on ATLAS-5348:
----------------------------------------
!Screenshot from 2026-08-05 17-35-17.png!
We can currently solve 0 of the remaining 3 vulnerabilities without causing
major issues for this PR.
Here is exactly why we can't safely fix them right now:
quill (1 vuln): There is simply no patched version published on npm yet for
this specific advisory
([GHSA-v3m3-f69x-jf25|https://github.com/advisories/GHSA-v3m3-f69x-jf25]). We
are physically unable to fix it until the package maintainers release a patch.
react-router (2 vulns): The security patch was only released in version 7.x.
The dashboard is currently on version 6 (6.30.4). Upgrading from React Router
v6 to v7 is a massive breaking change that would require rewriting the
application's routing logic. A framework migration like that is far too risky
and out-of-scope for a simple dependency-bump PR.
> Atlas React UI: Upgrading frontend transitive dependencies
> ----------------------------------------------------------
>
> Key: ATLAS-5348
> URL: https://issues.apache.org/jira/browse/ATLAS-5348
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
> Attachments: Screenshot from 2026-08-05 17-35-17.png
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags 8
> outdated transitive dependencies that need to be upgraded to their patched
> versions.
> This issue tracks running `npm audit fix` to automatically bump these
> frontend packages in the `package-lock.json` and resolve the following
> warnings:
> - **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment
> - **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping
> - **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped
> multipart field names (High Severity)
> - **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and
> ReDoS vulnerability (High Severity)
> - **postcss (<8.5.10):** XSS via Unescaped `</style>` in CSS Stringify Output
> (Moderate Severity)
> - **quill (=2.0.3):** XSS via HTML export feature
> - **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory
> exhaustion DoS (High Severity)
> - **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML
> collections (Moderate Severity)
> **Total:** 8 warnings (3 low, 2 moderate, 3 high)
> **Resolution:**
> Ran `npm audit fix` in the `dashboard` directory to update the
> `package-lock.json` and safely bump all affected transitive dependencies.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
