rfellows opened a new pull request, #11828: URL: https://github.com/apache/nifi/pull/11828
# Summary [NIFI-16482](https://issues.apache.org/jira/browse/NIFI-16482) Clears nifi-frontend npm audit findings that have a compatible fix, while staying on Angular 21 and Nx 22. The only files changed are `nifi-frontend/src/main/frontend/package.json` and `package-lock.json`. Before this branch the audit reported 5 critical, 33 high, and 1 moderate (39 total), and `@angular/router` was the only production dependency in that set. After this branch it reports 0 critical, 17 high, and 0 moderate (17 total). All 17 remaining findings are high severity devDependencies. ## Triage | | Critical | High | Moderate | Total | | --- | --- | --- | --- | --- | | Before | 5 | 33 | 1 | 39 | | After | 0 | 17 | 0 | 17 | Before, only `@angular/router` was a production dependency. Everything else in the audit was a devDependency. The 17 findings that remain are all high and dev-only. What changed: - Stale overrides that no longer suppress advisories are removed, including `undici`, `picomatch`, `serialize-javascript`, `js-yaml`, and several `brace-expansion` pins. - Compatible patch and minor overrides and direct dependencies are raised: Analog to `^2.8.1` (resolved 2.9.1, which drops `ts-morph`), `piscina` `^5.3.2`, `proxy-addr` `^2.0.8`, `shell-quote` `^1.12.0`, `compression` `^1.8.2`, `follow-redirects` `^1.16.1`, `http-cache-semantics` `^4.3.0`, `launch-editor` `^2.14.2`, `source-map-js` `^1.2.2`, `postcss-selector-parser` `^7.1.6` (installed 7.1.7), `@modelcontextprotocol/sdk` `^1.32.0` (installed 1.32.1), `smol-toml` floor `^1.9.0` (installed 1.9.1), and a `vite` override of `^7.3.7` (installed 7.3.7). - Angular framework packages move from 21.2.24 to 21.2.25: `animations`, `common`, `compiler`, `core`, `forms`, `platform-browser`, `platform-browser-dynamic`, `router`, and `compiler-cli`. CDK and Material stay at 21.2.14. `@angular/cli`, `@angular/build`, and `@angular-devkit` stay at 21.2.24. - `nx`, `@nx/angular`, `@nx/eslint`, `@nx/eslint-plugin`, and `@nx/workspace` move from 22.7.8 to 22.7.12. This is the Nx 22 line, not Nx 23. Left in place on purpose: `[email protected]` and `[email protected]` have no newer release, and the parents that still pull them (`webpack-dev-server` 5.2.x via chokidar 3, and `@rspack/dev-server` 1.2.1 via selfsigned 2) have no same-major fix. `@rspack/dev-server` 2.x would be a major bump and was not taken. `ts-checker-rspack-plugin` 1.7.1 is a possible minor override and was not included (the lockfile has 1.6.0). Open apache/nifi Dependabot pull requests this change addresses: | PR | What Dependabot proposed | Status in this PR | | --- | --- | --- | | https://github.com/apache/nifi/pull/11769 | shell-quote 1.10.0 to 1.12.0 | Satisfied. Override ^1.12.0, installed 1.12.0. | | https://github.com/apache/nifi/pull/11785 | proxy-addr 2.0.7 to 2.0.8 | Satisfied. Override ^2.0.8, installed 2.0.8. | | https://github.com/apache/nifi/pull/11786 | source-map-js 1.2.1 to 1.2.2 | Satisfied. Override ^1.2.2, installed 1.2.2. | | https://github.com/apache/nifi/pull/11823 | @angular/router 21.2.24 to 21.2.25 | Satisfied. Framework packages pinned to 21.2.25, including router. | | https://github.com/apache/nifi/pull/11825 | follow-redirects plus Nx to 23.3.0 | Partial. follow-redirects is at 1.16.1. Nx is at 22.7.12, which is the in-major fix. Nx 23.3.0 was not taken. | | https://github.com/apache/nifi/pull/11771 | @angular/cli to 22.2.1 and drop @modelcontextprotocol/sdk | Superseded. SDK override ^1.32.0 (installed 1.32.1) clears the CLI advisory. CLI stays on 21.2.24. Angular 22 was not taken. | -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
