ASolarers-Rodriguez opened a new pull request, #43406: URL: https://github.com/apache/superset/pull/43406
### Summary `superset-frontend`'s Snyk scan flags `SNYK-JS-JSYAML-18593780` (js-yaml 4.3.0), which corresponds to [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj) — quadratic CPU consumption (`O(n^2)`) in `!!omap` resolution, a DoS reachable via a plain `yaml.load()` call on untrusted input with default options. - Affected: js-yaml `>=4.0.0 <4.3.1` and `>=3.0.0 <3.15.1` - Fixed in: **4.3.1** (4.x line) and **3.15.1** (3.x line), both published 2026-07-31 - Verified via npm dist-tags (`v4-legacy: 4.3.1`, `v3-legacy: 3.15.1`) and OSV, which reports 0 known vulnerabilities for [email protected] vs. 1 for 4.3.0 ### Why lockfile-only Every consumer of js-yaml in this tree already declares a range that admits the patched version, so **no `package.json` change is needed**: | Consumer | Declared range | Before | After | |---|---|---|---| | `overrides.lerna.js-yaml` | `^4.3.0` | 4.3.0 | 4.3.1 | | `[email protected]` (root) | `^4.1.0` | 4.3.0 | 4.3.1 | | `lerna`'s nested `[email protected]` | `^4.1.0` | 4.3.0 (deduped) | 4.3.1 (deduped) | | `[email protected]` | `^4.2.0` | 4.3.0 | 4.3.1 | | `stylelint`'s nested `[email protected]` | `^4.1.0` | 4.3.0 | 4.3.1 | | `[email protected]` / `@istanbuljs/load-nyc-config` (root, 3.x) | `^3.13.1` | 3.15.0 | 3.15.1 | This intentionally avoids adding/broadening a `package.json` `overrides` entry. A prior attempt at a different transitive-dependency CVE fix (#42435) used a broad `overrides` block that crossed a major-version boundary into `lerna`'s pinned `[email protected]` chain and broke `lint-frontend`/`validate-frontend` with `TypeError: expand is not a function` in `Minimatch.braceExpand`. That was fixed by a lockfile-only replacement (#42583). This PR follows the same minimal, lockfile-only pattern — it changes exactly 5 `js-yaml` entries in `package-lock.json` and nothing else. ### Test plan - [x] `npm ls js-yaml --all` — every resolved instance is now `>= 4.3.1` (4.x line) or `3.15.1` (3.x line); see proof comment. - [x] `git diff <merge-base> --stat` — only `superset-frontend/package-lock.json`, 15 insertions / 15 deletions. - [x] `npx eslint --version` still resolves (v10.8.1) and a direct `minimatch`/`braceExpand` smoke check succeeds — confirms this PR does not reproduce the #42435 failure mode. - [ ] CI (lint-frontend / validate-frontend / unit tests) — pending, will confirm here once CI reports. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
