rusackas opened a new pull request, #43663: URL: https://github.com/apache/superset/pull/43663
### SUMMARY Patches Dependabot alerts #1514 and #1513: js-yaml has a quadratic-CPU-consumption DoS in `!!omap` resolution, affecting both the 3.x and 4.x lines (fixed in 3.15.1 and 4.3.1 respectively). `js-yaml` is transitive-only in `superset-frontend/package-lock.json` — five instances across two major-version lines: | Instance | Required by | Before | After | |---|---|---|---| | top-level (dev) | `@istanbuljs/load-nyc-config`, `js-yaml-loader` | 3.15.0 | 3.15.1 | | `cosmiconfig` (dev) | cosmiconfig ^4.1.0 | 4.3.0 | 4.3.1 | | `lerna` (dev) | lerna, hard-pinned | 4.3.0 | 4.3.1 | | `react-diff-viewer-continued` (runtime) | ^4.2.0 | 4.3.0 | 4.3.1 | | `stylelint` (dev, via its own cosmiconfig) | ^4.1.0 | 4.3.0 | 4.3.1 | Added per-consumer overrides in `package.json` rather than one blanket override, since the 3.x and 4.x consumers are on incompatible major versions with a different API (`safeLoad` vs `load`) — a single global override would force one line onto consumers expecting the other. ### TESTING INSTRUCTIONS Transitive dependency patch only. Confirmed no application code imports `js-yaml` directly — `webpack.config.js` references the separate `js-yaml-loader` package by name (a build-time-only webpack loader for parsing YAML fixtures), not `js-yaml` itself. No new test needed; existing CI is the regression check. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
