This is an automated email from the ASF dual-hosted git repository.
tbonelee pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git
The following commit(s) were added to refs/heads/master by this push:
new 4b36aa4745 [HOTFIX] Dedupe minimatch and bump postcss in zeppelin-react
4b36aa4745 is described below
commit 4b36aa474568fddd869c6e8c3e00acfb1728ab35
Author: YONGJAE LEE (이용재) <[email protected]>
AuthorDate: Mon Jul 27 23:19:12 2026 +0900
[HOTFIX] Dedupe minimatch and bump postcss in zeppelin-react
### What is this PR for?
The `npm-audit` job fails on master with seven high findings, all in
`devDependencies`:
- `brace-expansion <=5.0.7`, GHSA-mh99-v99m-4gvg (DoS via unbounded
expansion)
- `postcss <=8.5.17`, GHSA-r28c-9q8g-f849 (path traversal in source map
auto-loading)
`minimatch<at>10.2.5` is already hoisted at the top of `zeppelin-react`'s
tree. The vulnerable `brace-expansion<at>1.1.16` comes from four *nested*
copies of `minimatch<at>3.1.5`, under `eslint`, `<at>eslint/eslintrc`,
`<at>eslint/config-array` and `eslint-plugin-react`. An `overrides` entry for
`minimatch` collapses those onto the version already present, removing
`minimatch<at>3` from the tree, and `brace-expansion` then moves 5.0.7 to 5.0.8.
`postcss` moves 8.5.15 to 8.5.23 in the lockfile (`npm audit fix`, no
`package.json` change; `nanoid` follows as its dependency). That is the same
bump as #5341, which this supersedes.
The result is `found 0 vulnerabilities`. The gate itself is unchanged:
still `--audit-level=high` over the full dependency tree, so `devDependencies`
keep their CI coverage.
Upgrading the eslint side is not an alternative here.
`eslint-plugin-react<at>7.37.5` is the latest release, declares
`minimatch<at>^3.1.2` itself, and does not run on eslint 10 (`TypeError:
contextOrFilename.getFilename is not a function` at `lib/util/version.js:31`),
so no version bump removes the nested copy. Overriding `brace-expansion` alone
does not work either, because 5.0.8 drops the CJS default export that
`minimatch<at>3.1.5` calls, which gives a green audit and `TypeError: [...]
The lockfile shrinks by 129 lines, dropping the four nested `minimatch` /
`brace-expansion` / `balanced-match` trees and `concat-map`.
### What type of PR is it?
Hot Fix
### Todos
### What is the Jira issue?
### How should this be tested?
The `npm-audit` job on this PR. Locally, from a deleted `node_modules` in
`zeppelin-web-angular/projects/zeppelin-react`:
```
$ npm ci --ignore-scripts && npm audit --audit-level=high
found 0 vulnerabilities # exit 0 (master: 7 high, exit 1)
$ npm run lint # exit 0
$ npm run build # exit 0
$ npm test # 14 passed
```
### Screenshots (if appropriate)
### Questions:
* Does the license files need to update? No
* Is there breaking changes for older versions? No
* Does this needs documentation? No
Closes #5352 from voidmatcha/fix/npm-audit-deps.
Signed-off-by: ChanHo Lee <[email protected]>
---
.../projects/zeppelin-react/package-lock.json | 153 ++-------------------
.../projects/zeppelin-react/package.json | 4 +-
2 files changed, 14 insertions(+), 143 deletions(-)
diff --git a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
index 2dd285a13c..4fa79386eb 100644
--- a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
+++ b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
@@ -501,37 +501,6 @@
"node": "^18.18.0 || ^20.9.0 || >=21.1.0"
}
},
- "node_modules/@eslint/config-array/node_modules/balanced-match": {
- "version": "1.0.2",
- "resolved":
"https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz";,
- "integrity":
"sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
- "dev": true,
- "license": "MIT"
- },
- "node_modules/@eslint/config-array/node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "balanced-match": "^1.0.0",
- "concat-map": "0.0.1"
- }
- },
- "node_modules/@eslint/config-array/node_modules/minimatch": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz";,
- "integrity":
"sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
- "dev": true,
- "license": "ISC",
- "dependencies": {
- "brace-expansion": "^1.1.7"
- },
- "engines": {
- "node": "*"
- }
- },
"node_modules/@eslint/config-helpers": {
"version": "0.4.2",
"resolved":
"https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz";,
@@ -582,24 +551,6 @@
"url": "https://opencollective.com/eslint";
}
},
- "node_modules/@eslint/eslintrc/node_modules/balanced-match": {
- "version": "1.0.2",
- "resolved":
"https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz";,
- "integrity":
"sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
- "dev": true,
- "license": "MIT"
- },
- "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "balanced-match": "^1.0.0",
- "concat-map": "0.0.1"
- }
- },
"node_modules/@eslint/eslintrc/node_modules/globals": {
"version": "14.0.0",
"resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz";,
@@ -623,19 +574,6 @@
"node": ">= 4"
}
},
- "node_modules/@eslint/eslintrc/node_modules/minimatch": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz";,
- "integrity":
"sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
- "dev": true,
- "license": "ISC",
- "dependencies": {
- "brace-expansion": "^1.1.7"
- },
- "engines": {
- "node": "*"
- }
- },
"node_modules/@eslint/js": {
"version": "9.39.4",
"resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz";,
@@ -3345,16 +3283,16 @@
"license": "ISC"
},
"node_modules/brace-expansion": {
- "version": "5.0.7",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz";,
- "integrity":
"sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+ "version": "5.0.8",
+ "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz";,
+ "integrity":
"sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
"dev": true,
"license": "MIT",
"dependencies": {
"balanced-match": "^4.0.2"
},
"engines": {
- "node": "18 || 20 || >=22"
+ "node": "20 || >=22"
}
},
"node_modules/braces": {
@@ -3774,13 +3712,6 @@
"integrity":
"sha512-VRhuHOLoKYOy4UbilLbUzbYg93XLjv2PncJC50EuTWPA3gaja1UjBsUP/D/9/juV3vQFr6XBEzn9KCAHdUvOHw==",
"license": "MIT"
},
- "node_modules/concat-map": {
- "version": "0.0.1",
- "resolved":
"https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz";,
- "integrity":
"sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
- "dev": true,
- "license": "MIT"
- },
"node_modules/connect-history-api-fallback": {
"version": "2.0.0",
"resolved":
"https://registry.npmjs.org/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz";,
@@ -4721,37 +4652,6 @@
"eslint": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0
|| ^9.0.0"
}
},
- "node_modules/eslint-plugin-react/node_modules/balanced-match": {
- "version": "1.0.2",
- "resolved":
"https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz";,
- "integrity":
"sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
- "dev": true,
- "license": "MIT"
- },
- "node_modules/eslint-plugin-react/node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "balanced-match": "^1.0.0",
- "concat-map": "0.0.1"
- }
- },
- "node_modules/eslint-plugin-react/node_modules/minimatch": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz";,
- "integrity":
"sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
- "dev": true,
- "license": "ISC",
- "dependencies": {
- "brace-expansion": "^1.1.7"
- },
- "engines": {
- "node": "*"
- }
- },
"node_modules/eslint-plugin-react/node_modules/semver": {
"version": "6.3.1",
"resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz";,
@@ -4792,24 +4692,6 @@
"url": "https://opencollective.com/eslint";
}
},
- "node_modules/eslint/node_modules/balanced-match": {
- "version": "1.0.2",
- "resolved":
"https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz";,
- "integrity":
"sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
- "dev": true,
- "license": "MIT"
- },
- "node_modules/eslint/node_modules/brace-expansion": {
- "version": "1.1.16",
- "resolved":
"https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz";,
- "integrity":
"sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
- "dev": true,
- "license": "MIT",
- "dependencies": {
- "balanced-match": "^1.0.0",
- "concat-map": "0.0.1"
- }
- },
"node_modules/eslint/node_modules/eslint-visitor-keys": {
"version": "4.2.1",
"resolved":
"https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz";,
@@ -4833,19 +4715,6 @@
"node": ">= 4"
}
},
- "node_modules/eslint/node_modules/minimatch": {
- "version": "3.1.5",
- "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz";,
- "integrity":
"sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
- "dev": true,
- "license": "ISC",
- "dependencies": {
- "brace-expansion": "^1.1.7"
- },
- "engines": {
- "node": "*"
- }
- },
"node_modules/espree": {
"version": "10.4.0",
"resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz";,
@@ -7176,9 +7045,9 @@
}
},
"node_modules/nanoid": {
- "version": "3.3.12",
- "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz";,
- "integrity":
"sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==",
+ "version": "3.3.16",
+ "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz";,
+ "integrity":
"sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
"dev": true,
"funding": [
{
@@ -7782,9 +7651,9 @@
}
},
"node_modules/postcss": {
- "version": "8.5.15",
- "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz";,
- "integrity":
"sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+ "version": "8.5.23",
+ "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz";,
+ "integrity":
"sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
"dev": true,
"funding": [
{
@@ -7802,7 +7671,7 @@
],
"license": "MIT",
"dependencies": {
- "nanoid": "^3.3.12",
+ "nanoid": "^3.3.16",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.1"
},
diff --git a/zeppelin-web-angular/projects/zeppelin-react/package.json
b/zeppelin-web-angular/projects/zeppelin-react/package.json
index 18afbc004e..3cca715db9 100644
--- a/zeppelin-web-angular/projects/zeppelin-react/package.json
+++ b/zeppelin-web-angular/projects/zeppelin-react/package.json
@@ -52,6 +52,8 @@
"webpack-dev-server": "6.0.0"
},
"overrides": {
- "linkify-it": "^5.0.2"
+ "linkify-it": "^5.0.2",
+ "minimatch": "^10.2.4",
+ "brace-expansion": "^5.0.8"
}
}
