This is an automated email from the ASF dual-hosted git repository.
hainenber pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/master by this push:
new 734f8ed4c3 fix(sec): resolve Dependabot security alerts (#32274)
734f8ed4c3 is described below
commit 734f8ed4c3c6f852ecb8990e76dcac5960509c0a
Author: Đỗ Trọng Hải <[email protected]>
AuthorDate: Mon Feb 17 08:02:09 2025 +0700
fix(sec): resolve Dependabot security alerts (#32274)
---
docs/yarn.lock | 88 +++++++++---------------
pyproject.toml | 2 +-
requirements/base.in | 2 +-
requirements/base.txt | 6 +-
requirements/development.txt | 12 ++--
superset-frontend/cypress-base/package-lock.json | 30 ++++----
6 files changed, 58 insertions(+), 82 deletions(-)
diff --git a/docs/yarn.lock b/docs/yarn.lock
index 7460b02949..a2bc4067d3 100644
--- a/docs/yarn.lock
+++ b/docs/yarn.lock
@@ -4227,10 +4227,10 @@ [email protected]:
resolved
"https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz#e303a882b342cc3ee8ca513a79999734dab3ae2c";
integrity
sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==
[email protected]:
- version "0.6.0"
- resolved
"https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051";
- integrity
sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==
[email protected]:
+ version "0.7.1"
+ resolved
"https://registry.yarnpkg.com/cookie/-/cookie-0.7.1.tgz#2f73c42142d5d5cf71310a74fc4ae61670e5dbc9";
+ integrity
sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==
cookie@~0.7.2:
version "0.7.2"
@@ -5027,36 +5027,36 @@ execa@^5.0.0:
strip-final-newline "^2.0.0"
express@^4.17.3:
- version "4.20.0"
- resolved
"https://registry.yarnpkg.com/express/-/express-4.20.0.tgz#f1d08e591fcec770c07be4767af8eb9bcfd67c48";
- integrity
sha512-pLdae7I6QqShF5PnNTCVn4hI91Dx0Grkn2+IAsMTgMIKuQVte2dN9PeGSSAME2FR8anOhVA62QDIUaWVfEXVLw==
+ version "4.21.2"
+ resolved
"https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32";
+ integrity
sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==
dependencies:
accepts "~1.3.8"
array-flatten "1.1.1"
body-parser "1.20.3"
content-disposition "0.5.4"
content-type "~1.0.4"
- cookie "0.6.0"
+ cookie "0.7.1"
cookie-signature "1.0.6"
debug "2.6.9"
depd "2.0.0"
encodeurl "~2.0.0"
escape-html "~1.0.3"
etag "~1.8.1"
- finalhandler "1.2.0"
+ finalhandler "1.3.1"
fresh "0.5.2"
http-errors "2.0.0"
merge-descriptors "1.0.3"
methods "~1.1.2"
on-finished "2.4.1"
parseurl "~1.3.3"
- path-to-regexp "0.1.10"
+ path-to-regexp "0.1.12"
proxy-addr "~2.0.7"
- qs "6.11.0"
+ qs "6.13.0"
range-parser "~1.2.1"
safe-buffer "5.2.1"
send "0.19.0"
- serve-static "1.16.0"
+ serve-static "1.16.2"
setprototypeof "1.2.0"
statuses "2.0.1"
type-is "~1.6.18"
@@ -5163,13 +5163,13 @@ fill-range@^7.1.1:
dependencies:
to-regex-range "^5.0.1"
[email protected]:
- version "1.2.0"
- resolved
"https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.2.0.tgz#7d23fe5731b207b4640e4fcd00aec1f9207a7b32";
- integrity
sha512-5uXcUVftlQMFnWC9qu/svkWv3GTd2PfUhK/3PLkYNAe7FbqJMt3515HaxE6eRL74GdsriiwujiawdaB1BpEISg==
[email protected]:
+ version "1.3.1"
+ resolved
"https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.3.1.tgz#0c575f1d1d324ddd1da35ad7ece3df7d19088019";
+ integrity
sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==
dependencies:
debug "2.6.9"
- encodeurl "~1.0.2"
+ encodeurl "~2.0.0"
escape-html "~1.0.3"
on-finished "2.4.1"
parseurl "~1.3.3"
@@ -7713,10 +7713,10 @@ path-parse@^1.0.7:
resolved
"https://registry.yarnpkg.com/path-parse/-/path-parse-1.0.7.tgz#fbc114b60ca42b30d9daf5858e4bd68bbedb6735";
integrity
sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==
[email protected]:
- version "0.1.10"
- resolved
"https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b";
- integrity
sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==
[email protected]:
+ version "0.1.12"
+ resolved
"https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7";
+ integrity
sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==
[email protected]:
version "2.2.1"
@@ -7724,9 +7724,9 @@ [email protected]:
integrity
sha512-gu9bD6Ta5bwGrrU8muHzVOBFFREpp2iRkVfhBJahwJ6p6Xw20SjT0MxLnwkjOibQmGSYhiUnf2FLe7k+jcFmGQ==
path-to-regexp@^1.7.0:
- version "1.8.0"
- resolved
"https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.8.0.tgz#887b3ba9d84393e87a0a0b9f4cb756198b53548a";
- integrity
sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA==
+ version "1.9.0"
+ resolved
"https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-1.9.0.tgz#5dc0753acbf8521ca2e0f137b4578b917b10cf24";
+ integrity
sha512-xIp7/apCFJuUHdDLWe8O1HIkb0kQrOMb/0u6FXQjemHn/ii5LrIzU6bdECnsiTF/GjZkMEKg1xdiZwNqDYlZ6g==
dependencies:
isarray "0.0.1"
@@ -8177,13 +8177,6 @@ pupa@^3.1.0:
dependencies:
escape-goat "^4.0.0"
[email protected]:
- version "6.11.0"
- resolved
"https://registry.yarnpkg.com/qs/-/qs-6.11.0.tgz#fd0d963446f7a65e1367e01abd85429453f0c37a";
- integrity
sha512-MvjoMCJwEarSbUYk5O+nmoSzSutSsTwF85zcHPQ9OrlFoZOYIjaqBAJIqIXjptyD5vThxGq52Xu/MaJzRkIk4Q==
- dependencies:
- side-channel "^1.0.4"
-
[email protected]:
version "6.13.0"
resolved
"https://registry.yarnpkg.com/qs/-/qs-6.13.0.tgz#6ca3bd58439f7e245655798997787b0d88a51906";
@@ -9289,25 +9282,6 @@ semver@^7.3.2, semver@^7.3.5, semver@^7.3.7,
semver@^7.5.4:
dependencies:
lru-cache "^6.0.0"
[email protected]:
- version "0.18.0"
- resolved
"https://registry.yarnpkg.com/send/-/send-0.18.0.tgz#670167cc654b05f5aa4a767f9113bb371bc706be";
- integrity
sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==
- dependencies:
- debug "2.6.9"
- depd "2.0.0"
- destroy "1.2.0"
- encodeurl "~1.0.2"
- escape-html "~1.0.3"
- etag "~1.8.1"
- fresh "0.5.2"
- http-errors "2.0.0"
- mime "1.6.0"
- ms "2.1.3"
- on-finished "2.4.1"
- range-parser "~1.2.1"
- statuses "2.0.1"
-
[email protected]:
version "0.19.0"
resolved
"https://registry.yarnpkg.com/send/-/send-0.19.0.tgz#bbc5a388c8ea6c048967049dbeac0e4a3f09d7f8";
@@ -9368,15 +9342,15 @@ serve-index@^1.9.1:
mime-types "~2.1.17"
parseurl "~1.3.2"
[email protected]:
- version "1.16.0"
- resolved
"https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.0.tgz#2bf4ed49f8af311b519c46f272bf6ac3baf38a92";
- integrity
sha512-pDLK8zwl2eKaYrs8mrPZBJua4hMplRWJ1tIFksVC3FtBEBnl8dxgeHtsaMS8DhS9i4fLObaon6ABoc4/hQGdPA==
[email protected]:
+ version "1.16.2"
+ resolved
"https://registry.yarnpkg.com/serve-static/-/serve-static-1.16.2.tgz#b6a5343da47f6bdd2673848bf45754941e803296";
+ integrity
sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==
dependencies:
- encodeurl "~1.0.2"
+ encodeurl "~2.0.0"
escape-html "~1.0.3"
parseurl "~1.3.3"
- send "0.18.0"
+ send "0.19.0"
set-function-length@^1.2.1:
version "1.2.2"
@@ -9451,7 +9425,7 @@ short-unique-id@^5.0.2:
resolved
"https://registry.yarnpkg.com/short-unique-id/-/short-unique-id-5.2.0.tgz#a7e0668e0a8998d3151f27a36cf046055b1f270b";
integrity
sha512-cMGfwNyfDZ/nzJ2k2M+ClthBIh//GlZl1JEf47Uoa9XR11bz8Pa2T2wQO4bVrRdH48LrIDWJahQziKo3MjhsWg==
-side-channel@^1.0.4, side-channel@^1.0.6:
+side-channel@^1.0.6:
version "1.0.6"
resolved
"https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.6.tgz#abd25fb7cd24baf45466406b1096b7831c9215f2";
integrity
sha512-fDW/EZ6Q9RiO8eFG8Hj+7u/oW+XrPTIChwCOM2+th2A6OblDtYYIpve9m+KvI9Z4C9qSEXlaGR6bTEYHReuglA==
diff --git a/pyproject.toml b/pyproject.toml
index 5d0b737429..c8791694e5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -113,7 +113,7 @@ bigquery = [
]
clickhouse = ["clickhouse-connect>=0.5.14, <1.0"]
cockroachdb = ["cockroachdb>=0.3.5, <0.4"]
-cors = ["flask-cors>=2.0.0"]
+cors = ["flask-cors>=4.0.2, <5.0"]
crate = ["sqlalchemy-cratedb>=0.40.1, <1"]
databend = ["databend-sqlalchemy>=0.3.2, <1.0"]
databricks = [
diff --git a/requirements/base.in b/requirements/base.in
index 3cf3592154..abae3a1507 100644
--- a/requirements/base.in
+++ b/requirements/base.in
@@ -16,7 +16,7 @@
# specific language governing permissions and limitations
# under the License.
#
-urllib3>=1.26.18
+urllib3>=1.26.19, <2.0.0
werkzeug>=3.0.1
numexpr>=2.9.0
diff --git a/requirements/base.txt b/requirements/base.txt
index e94d77e270..391290ba39 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -173,7 +173,7 @@ itsdangerous==2.2.0
# via
# flask
# flask-wtf
-jinja2==3.1.4
+jinja2==3.1.5
# via
# flask
# flask-babel
@@ -252,7 +252,7 @@ parsedatetime==2.6
# via apache-superset (pyproject.toml)
pgsanity==0.2.9
# via apache-superset (pyproject.toml)
-platformdirs==3.8.1
+platformdirs==3.9.1
# via requests-cache
ply==3.11
# via jsonpath-ng
@@ -385,7 +385,7 @@ tzdata==2024.2
# pandas
url-normalize==1.4.3
# via requests-cache
-urllib3==1.26.18
+urllib3==1.26.20
# via
# -r requirements/base.in
# requests
diff --git a/requirements/development.txt b/requirements/development.txt
index 96ef635670..230f14150d 100644
--- a/requirements/development.txt
+++ b/requirements/development.txt
@@ -206,7 +206,7 @@ flask-compress==1.17
# via
# -c requirements/base.txt
# apache-superset
-flask-cors==4.0.0
+flask-cors==4.0.2
# via apache-superset
flask-jwt-extended==4.7.1
# via
@@ -362,7 +362,7 @@ itsdangerous==2.2.0
# -c requirements/base.txt
# flask
# flask-wtf
-jinja2==3.1.4
+jinja2==3.1.5
# via
# -c requirements/base.txt
# flask
@@ -530,7 +530,7 @@ pillow==10.3.0
# via
# apache-superset
# matplotlib
-platformdirs==3.8.1
+platformdirs==3.9.1
# via
# -c requirements/base.txt
# requests-cache
@@ -545,7 +545,7 @@ polyline==2.0.2
# via
# -c requirements/base.txt
# apache-superset
-pre-commit==4.0.1
+pre-commit==4.1.0
# via apache-superset
prison==0.2.1
# via
@@ -836,7 +836,7 @@ url-normalize==1.4.3
# via
# -c requirements/base.txt
# requests-cache
-urllib3==1.26.18
+urllib3==1.26.20
# via
# -c requirements/base.txt
# docker
@@ -849,7 +849,7 @@ vine==5.1.0
# amqp
# celery
# kombu
-virtualenv==20.23.1
+virtualenv==20.29.2
# via pre-commit
wcwidth==0.2.13
# via
diff --git a/superset-frontend/cypress-base/package-lock.json
b/superset-frontend/cypress-base/package-lock.json
index 60719f539e..eae3221dcb 100644
--- a/superset-frontend/cypress-base/package-lock.json
+++ b/superset-frontend/cypress-base/package-lock.json
@@ -5062,9 +5062,10 @@
}
},
"node_modules/cookie": {
- "version": "0.6.0",
- "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz";,
- "integrity":
"sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+ "version": "0.7.2",
+ "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz";,
+ "integrity":
"sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+ "license": "MIT",
"engines": {
"node": ">= 0.6"
}
@@ -7540,11 +7541,12 @@
}
},
"node_modules/light-my-request": {
- "version": "5.13.0",
- "resolved":
"https://registry.npmjs.org/light-my-request/-/light-my-request-5.13.0.tgz";,
- "integrity":
"sha512-9IjUN9ZyCS9pTG+KqTDEQo68Sui2lHsYBrfMyVUTTZ3XhH8PMZq7xO94Kr+eP9dhi/kcKsx4N41p2IXEBil1pQ==",
+ "version": "5.14.0",
+ "resolved":
"https://registry.npmjs.org/light-my-request/-/light-my-request-5.14.0.tgz";,
+ "integrity":
"sha512-aORPWntbpH5esaYpGOOmri0OHDOe3wC5M2MQxZ9dvMLZm6DnaAn0kJlcbU9hwsQgLzmZyReKwFwwPkR+nHu5kA==",
+ "license": "BSD-3-Clause",
"dependencies": {
- "cookie": "^0.6.0",
+ "cookie": "^0.7.0",
"process-warning": "^3.0.0",
"set-cookie-parser": "^2.4.1"
}
@@ -14784,9 +14786,9 @@
}
},
"cookie": {
- "version": "0.6.0",
- "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz";,
- "integrity":
"sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw=="
+ "version": "0.7.2",
+ "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz";,
+ "integrity":
"sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="
},
"core-js-compat": {
"version": "3.30.1",
@@ -16645,11 +16647,11 @@
}
},
"light-my-request": {
- "version": "5.13.0",
- "resolved":
"https://registry.npmjs.org/light-my-request/-/light-my-request-5.13.0.tgz";,
- "integrity":
"sha512-9IjUN9ZyCS9pTG+KqTDEQo68Sui2lHsYBrfMyVUTTZ3XhH8PMZq7xO94Kr+eP9dhi/kcKsx4N41p2IXEBil1pQ==",
+ "version": "5.14.0",
+ "resolved":
"https://registry.npmjs.org/light-my-request/-/light-my-request-5.14.0.tgz";,
+ "integrity":
"sha512-aORPWntbpH5esaYpGOOmri0OHDOe3wC5M2MQxZ9dvMLZm6DnaAn0kJlcbU9hwsQgLzmZyReKwFwwPkR+nHu5kA==",
"requires": {
- "cookie": "^0.6.0",
+ "cookie": "^0.7.0",
"process-warning": "^3.0.0",
"set-cookie-parser": "^2.4.1"
}
