hanahmily opened a new pull request, #1212: URL: https://github.com/apache/skywalking-banyandb/pull/1212
## Why Resolves the 6 open [Dependabot alerts](https://github.com/apache/skywalking-banyandb/security/dependabot). All 6 required **major-version** bumps that fall outside the previous semver ranges, so no in-range/automatic bump could clear them: | Package | Alert | Severity | Before | After | |---------|-------|----------|--------|-------| | vitest | GHSA-5xrq-8626-4rwp | **critical** | `^2.1.9` | `^3.2.6` | | vite | GHSA-fx2h-pf6j-xcff | high | 5.4.21 (transitive) | 7.x | | vite | GHSA-v6wh-96g9-6wx3 / GHSA-4w7w-66w2-5vf9 | moderate | 5.4.21 (transitive) | 7.x | | esbuild | GHSA-67mh-4wv8-2f99 | moderate | 0.21.5 (nested under vite) | cleared | | echarts | GHSA-fgmj-fm8m-jvvx | moderate | `^5.5.0` | `^6.1.0` | The five `mcp` alerts share a single root cause: `vitest` pinned to the 2.x major dragged along the vulnerable `vite 5` / `esbuild 0.21` transitively. Bumping `vitest` to `^3.2.6` clears all five. The `ui` alert is fixed by `echarts` `^5.5.0 → ^6.1.0`. ## Changes - `mcp/package.json`: `vitest` `^2.1.9 → ^3.2.6` (+ regenerated lockfile) - `ui/package.json`: `echarts` `^5.5.0 → ^6.1.0` (+ regenerated lockfile) - `ui/LICENSE` + `dist/LICENSE`: regenerated via `make license-dep` (`echarts 5.6.0 → 6.1.0`, `zrender 5.6.1 → 6.1.0`) ## Verification - `make -C mcp test` (vitest 3.2.7): 9/9 pass - `ui` `vite build` with echarts 6: succeeds - `npm audit`: 0 vulnerabilities in both `mcp` and `ui` - `make license-dep` regenerated; working tree clean (passes CI consistency gate) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
