Brijesh619 opened a new pull request, #736:
URL: https://github.com/apache/atlas/pull/736

   ## What changes were proposed in this pull request?
   
   The legacy `dashboardv2` module requires dependency upgrades to address 
outdated sub-packages and close open Dependabot pull requests. Because 
`dashboardv2` is tied to the older npm v6 build environment via Maven, 
attempting to upgrade deeply nested sub-dependencies using manual `resolutions` 
or `overrides` is unsupported.
   
   This PR cleanly resolves the outdated dependencies and vulnerabilities by 
natively upgrading their top-level parent build tools in `package.json` to 
exact pinned versions. 
   
   **Changes include:**
   1. Upgraded `grunt` to `1.6.3` (Inherently pulls in a modernized version of 
`micromatch` to resolve **`picomatch`** vulnerabilities - PR #588 & PR #579).
   2. Upgraded `grunt-contrib-connect` to `5.0.1` (Inherently pulls in 
modernized versions of **`serve-static`** and **`send`** vulnerabilities - PR 
#254 & PR #253).
   3. Upgraded `grunt-contrib-cssmin` to `4.0.0` (Inherently resolves nested 
**`clean-css`** and **`trim-newlines`** vulnerabilities while retaining strict 
Node 12 compatibility).
   4. Removed ineffective `overrides` blocks from `package.json` to rely 
entirely on native, safe npm dependency resolution.
   5. Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the 
strictly enforced Node v12.16.0 / npm v6.13.7 environment.
   
   ## How was this patch tested?
   
   * **Manual Node/NPM Test:** Cleared `node_modules` and ran `npm install` 
inside `dashboardv2` using the project-mandated Node v12.16.0 and npm v6.13.7 
binaries to guarantee lockfile compatibility.
   * **Audit Verification:** Ran `npm audit` to confirm that the `picomatch`, 
`serve-static`, `send`, `clean-css`, and `trim-newlines` vulnerabilities are 
completely eliminated from the dependency tree.
   * **Maven Build Test:** Verified the full build passes successfully by 
running `mvn clean -DskipTests -Drat.skip=false package 
-Pdist,embedded-hbase-solr` from the root directory.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to