Brijesh619 opened a new pull request, #736: URL: https://github.com/apache/atlas/pull/736
## What changes were proposed in this pull request? The legacy `dashboardv2` module requires dependency upgrades to address outdated sub-packages and close open Dependabot pull requests. Because `dashboardv2` is tied to the older npm v6 build environment via Maven, attempting to upgrade deeply nested sub-dependencies using manual `resolutions` or `overrides` is unsupported. This PR cleanly resolves the outdated dependencies and vulnerabilities by natively upgrading their top-level parent build tools in `package.json` to exact pinned versions. **Changes include:** 1. Upgraded `grunt` to `1.6.3` (Inherently pulls in a modernized version of `micromatch` to resolve **`picomatch`** vulnerabilities - PR #588 & PR #579). 2. Upgraded `grunt-contrib-connect` to `5.0.1` (Inherently pulls in modernized versions of **`serve-static`** and **`send`** vulnerabilities - PR #254 & PR #253). 3. Upgraded `grunt-contrib-cssmin` to `4.0.0` (Inherently resolves nested **`clean-css`** and **`trim-newlines`** vulnerabilities while retaining strict Node 12 compatibility). 4. Removed ineffective `overrides` blocks from `package.json` to rely entirely on native, safe npm dependency resolution. 5. Regenerated a clean `package-lock.json` (`lockfileVersion: 1`) using the strictly enforced Node v12.16.0 / npm v6.13.7 environment. ## How was this patch tested? * **Manual Node/NPM Test:** Cleared `node_modules` and ran `npm install` inside `dashboardv2` using the project-mandated Node v12.16.0 and npm v6.13.7 binaries to guarantee lockfile compatibility. * **Audit Verification:** Ran `npm audit` to confirm that the `picomatch`, `serve-static`, `send`, `clean-css`, and `trim-newlines` vulnerabilities are completely eliminated from the dependency tree. * **Maven Build Test:** Verified the full build passes successfully by running `mvn clean -DskipTests -Drat.skip=false package -Pdist,embedded-hbase-solr` from the root directory. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
