DoDiODev opened a new pull request, #9311: URL: https://github.com/apache/devlake/pull/9311
### Summary `config-ui/package.json` still lists `@ahooksjs/use-url-state`, but nothing imports it any more. The last `useUrlState` call was replaced by react-router's `useLocation` in #7841 (Aug 2024). The package is not just dead weight. It pulls in `decode-uri-component` 0.2.2 through `query-string@6`: ```text config-ui └─ @ahooksjs/[email protected] └─ [email protected] └─ [email protected] ``` That version is affected by two advisories: - [GHSA-vcc3-ghjq-m6fr](https://github.com/advisories/GHSA-vcc3-ghjq-m6fr): medium, fixed in 0.5.0 - [GHSA-qr28-fpjm-wq7f](https://github.com/advisories/GHSA-qr28-fpjm-wq7f): high, fixed in 0.5.1 Both describe denial of service on malformed percent-encoded input. Because the code is never bundled, there is no actual exposure. Security scanners still flag it, though. Dependabot cannot raise a fix for it either: from 0.3.0 onwards `decode-uri-component` is ESM-only, while `query-string@6` loads it with `require()`. A `resolutions` override would therefore break. This PR removes the dependency (`yarn remove @ahooksjs/use-url-state`). That also drops `query-string`, `decode-uri-component`, `filter-obj`, `split-on-first` and `strict-uri-encode` from `yarn.lock`. `ahooks` stays, because it is a direct dependency. ### Does this close any open issues? N/A ### Screenshots N/A (no UI change) ### Other Information - No runtime change: the `vite build` output (`dist/`) is byte-identical before and after this change. - Verified locally in `config-ui`: `tsc`, `eslint .` (0 errors), `yarn build` and `yarn test` (80/80) pass. - Fork CI on the same change (golangci-lint, unit-test, e2e on MySQL and PostgreSQL, config-ui, license header, Grafana check; 14/14 jobs green): https://github.com/DoDiODev/devlake/actions/runs/41605205365 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
