rfellows opened a new pull request, #11464: URL: https://github.com/apache/nifi/pull/11464
<!-- Licensed to the Apache Software Foundation (ASF) under one or more --> <!-- contributor license agreements. See the NOTICE file distributed with --> <!-- this work for additional information regarding copyright ownership. --> <!-- The ASF licenses this file to You under the Apache License, Version 2.0 --> <!-- (the "License"); you may not use this file except in compliance with --> <!-- the License. You may obtain a copy of the License at --> <!-- http://www.apache.org/licenses/LICENSE-2.0 --> <!-- Unless required by applicable law or agreed to in writing, software --> <!-- distributed under the License is distributed on an "AS IS" BASIS, --> <!-- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. --> <!-- See the License for the specific language governing permissions and --> <!-- limitations under the License. --> [NIFI-16138](https://issues.apache.org/jira/browse/NIFI-16138) ## Summary Resolves 26 of 32 open npm security advisories in `nifi-frontend` by adding and tightening `overrides` entries in `package.json`. No direct dependency versions are modified and no production code changes are made. The browser-shipped artifact is unaffected. All 2 critical and all 23 high advisories are cleared. The 6 remaining advisories are moderate severity and are confined to dev-only build tooling; they are deferred because their fixes require major-version bumps that carry unknown compatibility risk with the current Angular/Nx build toolchain. This PR supersedes the following open Dependabot PRs, which can be closed: - #11459 (fast-uri), #11458 (dompurify), #11457 (hono), #11454 (immutable), #11447 (axios), #11444 (adm-zip / @nx/angular), #11438 (websocket-driver) ## Vulnerability Counts | Severity | Before | After | |----------|--------|-------| | Critical | 2 | 0 | | High | 23 | 0 | | Moderate | 5 | 6 | | Low | 2 | 0 | | **Total** | **32** | **6** | ## Changes All changes are `overrides` entries in `nifi-frontend/src/main/frontend/package.json`. The `package-lock.json` is regenerated to reflect resolved transitive versions. No other files are modified. ### Updated existing overrides (floor was too permissive) | Package | Old override | New override | Reason | |---------|-------------|-------------|--------| | `undici` | `>=7.24.0` | `>=7.28.0` | Installed 7.24.4 still falls within the advisory range 7.0.0–7.27.2 | | `js-yaml` | `>=4.2.0` | `>=4.3.0` | Installed 4.2.0 is the exact upper bound of the advisory range | ### New overrides added | Package | Constraint | Semver delta | Severity | Scope | |---------|-----------|-------------|----------|-------| | `tar` | `>=7.5.19` | patch | critical | dev | | `websocket-driver` | `>=0.7.5` | patch | critical | dev | | `adm-zip` | `>=0.6.0` | minor | high | dev | | `axios` | `>=1.18.0` | minor | high | dev | | `fast-uri` | `>=3.1.4` | patch | high | dev | | `http-proxy-middleware` | `>=3.0.7 <4` | patch | high | dev | | `immutable` | `>=5.1.8` | patch | high | dev | | `piscina` | `>=5.2.0` | minor | high | dev | | `shell-quote` | `>=1.8.5` | patch | high | dev | | `svgo` | `>=3.3.4` | patch | high | dev | | `vite` | `^7.3.5` | patch | high | dev | | `hono` | `>=4.12.27` | patch | moderate | dev | | `body-parser` | `>=2.3.0` | minor | low | dev | | `dompurify` | `>=3.4.12` | patch | low | prod (transitive) | ### Cascade resolutions Several high advisories were cleared indirectly rather than by a direct override: - The `adm-zip` and `undici` overrides resolved the entire `@module-federation/*` cluster (`@module-federation/dts-plugin`, `cli`, `manifest`, `rspack`, `enhanced`, `node`) and consequently cleared the `@nx/module-federation`, `@nx/rspack`, and `@nx/angular` HIGH advisories. - The `http-proxy-middleware`, `piscina`, and `vite` overrides cleared the `@angular/build` HIGH advisory and partially cleared `@angular-devkit/build-angular`. - `brace-expansion` self-resolved to 5.0.8 (outside all advisory ranges) as a side effect of dependency tree re-resolution; no explicit override was needed. ## Remaining Vulnerabilities Six moderate advisories are intentionally deferred: **webpack-dev-server cluster** (GHSA-f5vj-f2hx-8m93, GHSA-m28w-2pqf-7qgj): No 5.x fix exists. Remediation requires upgrading to webpack-dev-server 6.x, which is a major version boundary and depends on an Angular build toolchain upgrade. **@hono/node-server cluster** (GHSA-frvp-7c67-39w9): `@angular/cli` pulls in `@modelcontextprotocol/sdk`, which requires `@hono/node-server@^1` (vulnerable below 2.0.5). The fix requires a 1.x→2.x major bump whose compatibility with the current `@modelcontextprotocol/sdk` version is untested. Both clusters are dev/build-tooling only and do not affect any artifact shipped to the browser. ## Verification `nx run-many -t lint` exits 0 across all 6 projects in `nifi-frontend` with these overrides applied. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
