This is an automated email from the ASF dual-hosted git repository.
LuciferYang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 4b0ca2227074 [SPARK-58726][INFRA][TEST] Fix npm vulnerabilities in dev
and ui-test
4b0ca2227074 is described below
commit 4b0ca2227074fbf5ce73d347a8f42dadb91cd523
Author: YangJie <[email protected]>
AuthorDate: Wed Aug 12 21:22:11 2026 +0800
[SPARK-58726][INFRA][TEST] Fix npm vulnerabilities in dev and ui-test
### What changes were proposed in this pull request?
This clears the high-severity `npm audit` advisories that Dependabot
reports against the two npm projects in the repo, `dev` and `ui-test`. All are
resolved in range by `npm audit fix --package-lock-only`, so only the two
`package-lock.json` files change; no `package.json` and no direct dependency is
touched.
Package version changes:
- `dev`: `fast-uri` 3.1.4 -> 3.1.5, `js-yaml` 4.3.0 -> 4.3.1,
`brace-expansion` 1.1.16 -> 1.1.18.
- `ui-test`: `js-yaml` 4.3.0 -> 4.3.1, and the several transitive
`brace-expansion` copies to their patched releases (5.0.7 -> 5.0.9, 2.1.2 ->
2.1.4 in three trees, 1.1.16 -> 1.1.18).
### Why are the changes needed?
`npm audit` reports these high-severity advisories:
- `fast-uri`
[GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7)
(CVE-2026-18446): host confusion via a backslash authority introducer.
`fast-uri` requires a literal `//` to recognize an authority, while Node's
WHATWG `URL` treats `\` as interchangeable with `/` for special schemes, so the
two parsers extract different hosts from the same input. Fixed in 3.1.5.
- `js-yaml`
[GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj):
quadratic CPU consumption in `!!omap` resolution. `resolveYamlOmap()` enforces
key uniqueness with a linear `indexOf` scan inside the per-element loop, making
`yaml.load()` O(n^2) in the number of entries. `!!omap` is in the default
schema, so a plain `yaml.load()` is affected. Fixed in 4.3.1.
- `brace-expansion`
[GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg) and
[GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895): DoS
via unbounded expansion length and via unbounded intermediate arrays.
This addresses https://github.com/apache/spark/security/dependabot/224,
https://github.com/apache/spark/security/dependabot/226 and
https://github.com/apache/spark/security/dependabot/225.
The `brace-expansion` bumps come along with `npm audit fix` rather than
being requested separately. Their Dependabot alerts (216-223) are already
auto-dismissed on the GitHub side, but `npm audit` still flags them locally, so
they are included here to leave the audit clean.
These are dev/test-only dependencies, but it is worth keeping the audit
clean.
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Locally, on the commit in this PR:
1. `npm audit` reports `found 0 vulnerabilities` in both projects (before:
3 high in `dev`, 2 high in `ui-test`).
2. `npm ci` reproduces both lockfiles cleanly and leaves them unmodified --
`dev`: `added 112 packages, and audited 113 packages`; `ui-test`: `added 342
packages, and audited 343 packages`.
3. `ui-test` jest suite passes: `Test Suites: 8 passed, 8 total` / `Tests:
22 passed, 22 total`.
4. `dev/lint-js` passes: `lint-js checks passed.`
5. Pass GitHub Actions.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Opus 5)
Closes #57950 from LuciferYang/fix-npm-vulns-aug2026.
Authored-by: YangJie <[email protected]>
Signed-off-by: yangjie01 <[email protected]>
---
dev/package-lock.json | 36 ++++++++++++++++++------------------
ui-test/package-lock.json | 38 +++++++++++++++++++-------------------
2 files changed, 37 insertions(+), 37 deletions(-)
diff --git a/dev/package-lock.json b/dev/package-lock.json
index 1075fcdbd473..f4b80a113c57 100644
--- a/dev/package-lock.json
+++ b/dev/package-lock.json
@@ -237,9 +237,9 @@
"dev": true
},
"node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+ "version": "1.1.18",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
+ "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -593,9 +593,9 @@
"dev": true
},
"node_modules/fast-uri": {
- "version": "3.1.4",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz";,
- "integrity":
"sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz";,
+ "integrity":
"sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
"dev": true,
"funding": [
{
@@ -802,9 +802,9 @@
"dev": true
},
"node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz";,
- "integrity":
"sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz";,
+ "integrity":
"sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
@@ -1416,9 +1416,9 @@
"dev": true
},
"brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+ "version": "1.1.18",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
+ "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"dev": true,
"requires": {
"balanced-match": "^1.0.0",
@@ -1692,9 +1692,9 @@
"dev": true
},
"fast-uri": {
- "version": "3.1.4",
- "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz";,
- "integrity":
"sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz";,
+ "integrity":
"sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
"dev": true
},
"file-entry-cache": {
@@ -1844,9 +1844,9 @@
"dev": true
},
"js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz";,
- "integrity":
"sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz";,
+ "integrity":
"sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"requires": {
"argparse": "^2.0.1"
diff --git a/ui-test/package-lock.json b/ui-test/package-lock.json
index 72e93e20a57f..447a8c5144b7 100644
--- a/ui-test/package-lock.json
+++ b/ui-test/package-lock.json
@@ -1058,9 +1058,9 @@
}
},
"node_modules/@jest/reporters/node_modules/brace-expansion": {
- "version": "2.1.2",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz";,
- "integrity":
"sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+ "version": "2.1.4",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
+ "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -2049,16 +2049,16 @@
}
},
"node_modules/brace-expansion": {
- "version": "5.0.7",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz";,
- "integrity":
"sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+ "version": "5.0.9",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz";,
+ "integrity":
"sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
- "node": "18 || 20 || >=22"
+ "node": "20 || >=22"
}
},
"node_modules/brace-expansion/node_modules/@isaacs/cliui": {
@@ -3131,9 +3131,9 @@
}
},
"node_modules/jest-config/node_modules/brace-expansion": {
- "version": "2.1.2",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz";,
- "integrity":
"sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+ "version": "2.1.4",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
+ "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3539,9 +3539,9 @@
}
},
"node_modules/jest-runtime/node_modules/brace-expansion": {
- "version": "2.1.2",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz";,
- "integrity":
"sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+ "version": "2.1.4",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz";,
+ "integrity":
"sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
"dev": true,
"license": "MIT",
"dependencies": {
@@ -3785,9 +3785,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz";,
- "integrity":
"sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz";,
+ "integrity":
"sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
@@ -4669,9 +4669,9 @@
}
},
"node_modules/test-exclude/node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+ "version": "1.1.18",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz";,
+ "integrity":
"sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
"dev": true,
"license": "MIT",
"dependencies": {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
