[
https://issues.apache.org/jira/browse/ATLAS-5348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5348:
-----------------------------------
Description:
Several frontend transitive dependencies in the Atlas React UI (`/dashboard`)
are outdated and contain known vulnerabilities. They need to be upgraded to
their patched versions.
This issue tracks safely upgrading primary dependencies to resolve vulnerable
sub-dependencies naturally, and explicitly utilizing a `package.json` override
only when necessary to avoid framework-breaking architectural changes.
*Dependabot PRs Resolved by this Ticket:*
* Bump axios in /dashboard - [https://github.com/apache/atlas/pull/624]
* Bump vite in /dashboard - [https://github.com/apache/atlas/pull/591]
* Bump follow-redirects in /dashboard -
[https://github.com/apache/atlas/pull/604]
* Bump flatted in /dashboard - [https://github.com/apache/atlas/pull/573]
* Bump picomatch in /dashboard - [https://github.com/apache/atlas/pull/581]
* Bump picomatch in /dashboard/src/views/Lineage/atlas-lineage -
[https://github.com/apache/atlas/pull/580]
* Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage -
[https://github.com/apache/atlas/pull/611]
*Primary Package Upgrades:*
* `recharts` (bumped to resolve vulnerable `lodash` and `victory-vendor`
dependencies)
* `react-quill-new` (bumped to resolve vulnerable `lodash-es` dependency)
*Overrides Added:*
* `d3-color` (Override added for `3.1.0` to resolve a High severity ReDoS
vulnerability without requiring a heavily breaking `d3` v5 to v7 migration).
*Other Upgraded Packages (via `package-lock.json` patching):*
* `@babel/core`
* `@tootallnate/once`
* `form-data`
* `picomatch`
* `ws`
* `yaml`
* `nanoid`
* `axios`
* `vite`
* `follow-redirects`
* `flatted`
*(Note: Prior manual overrides for `brace-expansion`, `js-yaml`, `postcss`,
`semver`, `minimatch`, `lodash`, and `lodash-es` were removed as they are now
resolved via main package upgrades or were creating invalid/broken dependency
trees).*
was:
Several frontend transitive dependencies in the Atlas React UI (`/dashboard`)
are outdated and contain known vulnerabilities. They need to be upgraded to
their patched versions.
This issue tracks safely upgrading primary dependencies to resolve vulnerable
sub-dependencies naturally, and explicitly utilizing a `package.json` override
only when necessary to avoid framework-breaking architectural changes.
**Dependabot PRs Resolved by this Ticket:**
* Bump axios in /dashboard - https://github.com/apache/atlas/pull/624
* Bump vite in /dashboard - https://github.com/apache/atlas/pull/591
* Bump follow-redirects in /dashboard -
https://github.com/apache/atlas/pull/604
* Bump flatted in /dashboard - https://github.com/apache/atlas/pull/573
* Bump picomatch in /dashboard - https://github.com/apache/atlas/pull/581
* Bump picomatch in /dashboard/src/views/Lineage/atlas-lineage -
https://github.com/apache/atlas/pull/580
* Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage -
https://github.com/apache/atlas/pull/611
**Primary Package Upgrades:**
* `recharts` (bumped to resolve vulnerable `lodash` and `victory-vendor`
dependencies)
* `react-quill-new` (bumped to resolve vulnerable `lodash-es` dependency)
**Overrides Added:**
* `d3-color` (Override added for `3.1.0` to resolve a High severity ReDoS
vulnerability without requiring a heavily breaking `d3` v5 to v7 migration).
**Other Upgraded Packages (via `package-lock.json` patching):**
* `@babel/core`
* `@tootallnate/once`
* `form-data`
* `picomatch`
* `ws`
* `yaml`
* `nanoid`
* `axios`
* `vite`
* `follow-redirects`
* `flatted`
*(Note: Prior manual overrides for `brace-expansion`, `js-yaml`, `postcss`,
`semver`, `minimatch`, `lodash`, and `lodash-es` were removed as they are now
resolved via main package upgrades or were creating invalid/broken dependency
trees).*
> Atlas React UI: Upgrading frontend transitive dependencies
> ----------------------------------------------------------
>
> Key: ATLAS-5348
> URL: https://issues.apache.org/jira/browse/ATLAS-5348
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 3.0.0, 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
> Time Spent: 2h 10m
> Remaining Estimate: 0h
>
> Several frontend transitive dependencies in the Atlas React UI (`/dashboard`)
> are outdated and contain known vulnerabilities. They need to be upgraded to
> their patched versions.
> This issue tracks safely upgrading primary dependencies to resolve vulnerable
> sub-dependencies naturally, and explicitly utilizing a `package.json`
> override only when necessary to avoid framework-breaking architectural
> changes.
> *Dependabot PRs Resolved by this Ticket:*
> * Bump axios in /dashboard - [https://github.com/apache/atlas/pull/624]
> * Bump vite in /dashboard - [https://github.com/apache/atlas/pull/591]
> * Bump follow-redirects in /dashboard -
> [https://github.com/apache/atlas/pull/604]
> * Bump flatted in /dashboard - [https://github.com/apache/atlas/pull/573]
> * Bump picomatch in /dashboard - [https://github.com/apache/atlas/pull/581]
> * Bump picomatch in /dashboard/src/views/Lineage/atlas-lineage -
> [https://github.com/apache/atlas/pull/580]
> * Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage
> - [https://github.com/apache/atlas/pull/611]
> *Primary Package Upgrades:*
> * `recharts` (bumped to resolve vulnerable `lodash` and `victory-vendor`
> dependencies)
> * `react-quill-new` (bumped to resolve vulnerable `lodash-es` dependency)
> *Overrides Added:*
> * `d3-color` (Override added for `3.1.0` to resolve a High severity ReDoS
> vulnerability without requiring a heavily breaking `d3` v5 to v7 migration).
> *Other Upgraded Packages (via `package-lock.json` patching):*
> * `@babel/core`
> * `@tootallnate/once`
> * `form-data`
> * `picomatch`
> * `ws`
> * `yaml`
> * `nanoid`
> * `axios`
> * `vite`
> * `follow-redirects`
> * `flatted`
> *(Note: Prior manual overrides for `brace-expansion`, `js-yaml`, `postcss`,
> `semver`, `minimatch`, `lodash`, and `lodash-es` were removed as they are now
> resolved via main package upgrades or were creating invalid/broken dependency
> trees).*
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
