LuciferYang opened a new pull request, #58772: URL: https://github.com/apache/spark/pull/58772
### What changes were proposed in this pull request? This clears the `npm audit` advisories that Dependabot reports against the two npm projects in the repo, `dev` and `ui-test`. All are resolved in range by `npm audit fix --package-lock-only`, so only the two `package-lock.json` files change; no `package.json` and no direct dependency is touched. Package version changes: - `dev`: `fast-uri` 3.1.5 -> 3.1.7, `js-yaml` 4.3.1 -> 4.3.2. - `ui-test`: `js-yaml` 4.3.1 -> 4.3.2, `browserslist` 4.28.2 -> 4.28.9, `baseline-browser-mapping` 2.10.37 -> 2.11.23, and the browser data packages that move with `browserslist`: `caniuse-lite` 1.0.30001799 -> 1.0.30001810, `electron-to-chromium` 1.5.375 -> 1.5.427, `node-releases` 2.0.47 -> 2.0.55, `update-browserslist-db` 1.2.3 -> 1.3.3. ### Why are the changes needed? `npm audit` reports these advisories: - `fast-uri`, four in one release: [GHSA-f65p-4m7j-42xc](https://github.com/advisories/GHSA-f65p-4m7j-42xc) server-side request forgery via malformed IPv6 normalization, [GHSA-jqff-g426-hqxp](https://github.com/advisories/GHSA-jqff-g426-hqxp) host confusion via percent-encoded scheme normalization, [GHSA-fph4-wmhf-6fwf](https://github.com/advisories/GHSA-fph4-wmhf-6fwf) server-side request forgery via repeated hostname percent-decoding, and [GHSA-5jgf-p345-68v8](https://github.com/advisories/GHSA-5jgf-p345-68v8) host confusion via skipped IDN canonicalization on scheme-relative references. All high, all fixed in 3.1.6. - `js-yaml` [GHSA-2883-xcg3-v3hh](https://github.com/advisories/GHSA-2883-xcg3-v3hh): `maxTotalMergeKeys` counts merged keys but not the merge sources themselves, so a document with many empty merge sources spends CPU without reaching the cap. High, fixed in 4.3.2. - `browserslist` [GHSA-73wf-gq98-2v4g](https://github.com/advisories/GHSA-73wf-gq98-2v4g) uncaught crash and prototype write in `normalizeStats` on untrusted `browserslist-stats.json` custom stats, and [GHSA-c83g-rgw3-j3cx](https://github.com/advisories/GHSA-c83g-rgw3-j3cx) unbounded memory growth from a query cache with no eviction. High, fixed in 4.28.7. - `baseline-browser-mapping` [GHSA-w5vr-8v7q-w6rv](https://github.com/advisories/GHSA-w5vr-8v7q-w6rv): process termination on invalid input. Medium, fixed in 2.11.0. This addresses https://github.com/apache/spark/security/dependabot/233, https://github.com/apache/spark/security/dependabot/234, https://github.com/apache/spark/security/dependabot/235, https://github.com/apache/spark/security/dependabot/236, https://github.com/apache/spark/security/dependabot/237, https://github.com/apache/spark/security/dependabot/239, https://github.com/apache/spark/security/dependabot/240 and https://github.com/apache/spark/security/dependabot/241. `npm audit fix` lands on 3.1.7 for `fast-uri` and 4.28.9 for `browserslist` rather than the first patched release of each, and pulls the `browserslist` data packages along; those are the latest in the ranges the lockfile already allows. These are dev/test-only dependencies, but it is worth keeping the audit clean. ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Locally, on the commit in this PR: 1. `npm audit` reports `found 0 vulnerabilities` in both projects (before: 2 high in `dev`, 2 high and 1 moderate in `ui-test`). 2. `npm ci` reproduces both lockfiles cleanly and leaves them unmodified. 3. `ui-test` jest suite passes: `Test Suites: 9 passed, 9 total` / `Tests: 24 passed, 24 total`. 4. `dev/lint-js` passes: `lint-js checks passed.` 5. Pass GitHub Actions. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Opus 5 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
