vatsrahul1001 opened a new pull request, #72948: URL: https://github.com/apache/airflow/pull/72948
`[email protected]` was pulled into the FAB provider's `www` lockfile (`providers/fab/src/airflow/providers/fab/www/pnpm-lock.yaml`) by earlier dependabot UI bumps on this branch. It is affected by four high-severity advisories (SSRF / host-confusion): GHSA-jqff-g426-hqxp, GHSA-fph4-wmhf-6fwf, GHSA-f65p-4m7j-42xc, GHSA-5jgf-p345-68v8 (3.x line patched at 3.1.6). This adds a pnpm `fast-uri` override bounded to the 3.x line (`>=3.1.6 <4`), which resolves to 3.1.7 — the same version `main` already ships — avoiding a major-version jump to 4.x. It also pins `[email protected]` so future bumps retain the security overrides, mirroring the treatment #72816 applied to the other UI packages but which skipped the FAB provider. Regenerating with the pinned pnpm additionally brings the lockfile back into compliance with the overrides already declared in `package.json` (postcss, picomatch, etc.), which the stale lockfile was not applying. This clears the `dependency-review` failure on the 3.3.2 sync PR #72946. A broader npm dependency review can follow after rc1. ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
