Dávid Paksy created HBASE-30494:
-----------------------------------
Summary: Upgrade @vitest, body-parser, fast-uri, happy-dom in
website to fix known security vulnerabilities
Key: HBASE-30494
URL: https://issues.apache.org/jira/browse/HBASE-30494
Project: HBase
Issue Type: Task
Components: dependencies, security
Reporter: Dávid Paksy
npm aufit before:
{noformat}
npm audit
# npm audit report
@vitest/mocker <=4.1.11
Severity: moderate
Vitest: Code injection via unauthenticated manual mock registration -
https://github.com/advisories/GHSA-qxg6-89mg-rqv8
Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect
allowlist fix - https://github.com/advisories/GHSA-xp26-3454-mjgp
fix available via `npm audit fix`
node_modules/@vitest/mocker
vitest 2.1.0-beta.1 - 4.1.11
Depends on vulnerable versions of @vitest/mocker
node_modules/vitest
body-parser 2.0.0 - 2.3.0
Severity: high
body-parser vulnerable to Denial of Service via trailing bytes after a
compressed request body - https://github.com/advisories/GHSA-27r3-jxmh-p828
fix available via `npm audit fix`
node_modules/body-parser
compression <1.8.2
Severity: high
compression vulnerable to Denial of Service via memory leak on premature
response close - https://github.com/advisories/GHSA-vc2v-76pw-4v95
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/compression
serve >=10.1.0
Depends on vulnerable versions of compression
node_modules/serve
fast-uri 3.0.0 - 3.1.8
Severity: moderate
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
- https://github.com/advisories/GHSA-w74x-v6f9-j3xg
fast-uri vulnerable to improper path equivalence in relative reference
normalization - https://github.com/advisories/GHSA-xhq7-xmqj-769h
fast-uri vulnerable to host confusion via unchecked WHATWG host
canonicalization - https://github.com/advisories/GHSA-wjr9-j795-jxcr
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in
suffix references - https://github.com/advisories/GHSA-333x-w4r6-6crp
fix available via `npm audit fix`
node_modules/fast-uri
happy-dom 17.0.0 - 21.0.3
Severity: high
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to
host code execution - https://github.com/advisories/GHSA-834v-8h66-3h79
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/happy-dom
katex 0.11.0 - 0.18.1
KaTeX: Existing prototype pollution can bypass trust restrictions -
https://github.com/advisories/GHSA-238p-pmpm-9mq7
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/micromark-extension-math/node_modules/katex
node_modules/rehype-katex/node_modules/katex
micromark-extension-math *
Depends on vulnerable versions of katex
node_modules/micromark-extension-math
remark-math >=4.0.0
Depends on vulnerable versions of micromark-extension-math
node_modules/remark-math
rehype-katex >=2.0.0
Depends on vulnerable versions of katex
node_modules/rehype-katex
postcss-selector-parser <7.1.6
Severity: moderate
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion -
https://github.com/advisories/GHSA-rj75-hqrm-r3gf
fix available via `npm audit fix --force`
Will install @tailwindcss/[email protected], which is a breaking change
node_modules/postcss-selector-parser
@tailwindcss/typography <=0.0.0-insiders.fda8ce5 || >=0.5.5
Depends on vulnerable versions of postcss-selector-parser
node_modules/@tailwindcss/typography
zod <4.6.6
Severity: high
Zod can exhaust memory while validating oversized constrained collections -
https://github.com/advisories/GHSA-mrhx-c7xc-m3w5
fix available via `npm audit fix`
node_modules/zod
14 vulnerabilities (4 low, 5 moderate, 5 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
{noformat}
After the fix:
{noformat}
9 vulnerabilities (4 low, 2 moderate, 3 high)
{noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
