rusackas opened a new pull request, #43665: URL: https://github.com/apache/superset/pull/43665
### SUMMARY `brace-expansion@^1.1.7` (required by `[email protected]`, pulled in transitively via `eslint` and `eslint-plugin-react` in `docs/`) was resolved at 1.1.15 — vulnerable to a series of DoS classes fixed progressively through 1.1.16 → 1.1.18: - unbounded expansion length causing an out-of-memory crash - exponential-time expansion of consecutive non-expanding braces - unbounded intermediate arrays bypassing an earlier partial fix for the above `minimatch`'s own declared range (`^1.1.7`) already permits the patched version — yarn's classic resolver was simply reusing the older lockfile entry rather than re-resolving it, since `yarn install` alone doesn't upgrade a transitive dependency already satisfied by an existing lockfile entry. Bumped in place to 1.1.18. The other two `brace-expansion` instances already in this lockfile (5.0.7, 5.0.9 — an unrelated major rewrite pulled in elsewhere in the docs toolchain) were already unaffected; these CVEs are scoped to the 1.x line. Fixes Dependabot alerts #1482, #1477, #1402. ### TESTING INSTRUCTIONS Transitive lockfile-only version bump — no source or docs content changed, so no new tests are needed. `yarn install` resolves cleanly with no dependency-graph shuffle beyond the one patched entry (diff is 3 changed lines: version, tarball URL, integrity hash). CI's docs build is the regression check. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
