This is an automated email from the ASF dual-hosted git repository.
voidmatcha pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git
The following commit(s) were added to refs/heads/master by this push:
new 81e5de88d0 [HOTFIX] Update vulnerable Vite and launch-editor
dependencies in zeppelin-react
81e5de88d0 is described below
commit 81e5de88d07270b950c056fe0f2628efcfa0feac
Author: Minho Jang <[email protected]>
AuthorDate: Wed Oct 21 21:48:32 2026 +0900
[HOTFIX] Update vulnerable Vite and launch-editor dependencies in
zeppelin-react
### What is this PR for?
Updates development dependencies in zeppelin-react to address
vulnerabilities in editor-launching code:
- GHSA-587h-7wmj-h5pm (https://github.com/advisories/GHSA-587h-7wmj-h5pm):
Windows file-existence check bypass — high severity.
- GHSA-698v-4r3x-3vcv (https://github.com/advisories/GHSA-698v-4r3x-3vcv):
missing Windows % escaping — moderate severity.
- GHSA-r825-w8mm-5pxw (https://github.com/advisories/GHSA-r825-w8mm-5pxw):
editor CLI argument misinterpretation — moderate severity.
Changes:
- Update Vite from `8.2.1` to `8.2.4`, which includes the editor-launching
fixes.
- Update the transitive launch-editor dependency used by webpack-dev-server
from `2.14.1` to `2.14.2` in the lockfile.
### What type of PR is it?
Bug Fix
### How should this be tested?
In `zeppelin-web-angular/projects/zeppelin-react`:
```sh
npm ci --ignore-scripts --no-audit
npm run apply:patches
npm run audit
npm test
```
All commands passed locally. The React test suite passed with 28 test files
and 262 tests.
Closes #5583 from miinhho/npm-audit-hotfix.
Signed-off-by: YONGJAE LEE <[email protected]>
---
.../projects/zeppelin-react/package-lock.json | 22 +++++++++++-----------
.../projects/zeppelin-react/package.json | 2 +-
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
index 18dd833701..b8bff3bcdf 100644
--- a/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
+++ b/zeppelin-web-angular/projects/zeppelin-react/package-lock.json
@@ -59,7 +59,7 @@
"typescript": "5.9.3",
"typescript-eslint": "^8.33.1",
"unified": "11.0.5",
- "vite": "8.2.1",
+ "vite": "8.2.4",
"vitest": "4.1.11",
"webpack": "5.105.4",
"webpack-cli": "5.1.4",
@@ -9846,14 +9846,14 @@
}
},
"node_modules/launch-editor": {
- "version": "2.14.1",
- "resolved":
"https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.1.tgz";,
- "integrity":
"sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==",
+ "version": "2.14.2",
+ "resolved":
"https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.2.tgz";,
+ "integrity":
"sha512-NHJEb30MGBCkmZXLZwz25t37QR4aY03ZzPYUJXOJaOa92uWwExI9SBQUuIznBYc1xkD7cJNGX7oc3Nl3sq2kQQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"picocolors": "^1.1.1",
- "shell-quote": "^1.8.4"
+ "shell-quote": "^1.10.0"
}
},
"node_modules/levn": {
@@ -15082,16 +15082,16 @@
}
},
"node_modules/vite": {
- "version": "8.2.1",
- "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.1.tgz";,
- "integrity":
"sha512-EU/eS7BH3XROHh2YnBefjM6DBKA6ZeMZEYQbj7NLWg5wHYlhB8B/Mayd5XsgWq+NFYccDOTemRpdETWR6Ka/lw==",
+ "version": "8.2.4",
+ "resolved": "https://registry.npmjs.org/vite/-/vite-8.2.4.tgz";,
+ "integrity":
"sha512-lfauXnrf2x0p+UoA+wXh0dgFWnUjCyG6Js95KBkgaCwUU9k0DAHI4W6Q0WCx+h+5g+Alce1y4Zi2QjjK0UvGBw==",
"dev": true,
"license": "MIT",
"dependencies": {
"lightningcss": "^1.33.0",
"picomatch": "^4.0.5",
- "postcss": "^8.5.25",
- "rolldown": "~1.2.1",
+ "postcss": "^8.5.26",
+ "rolldown": "~1.2.4",
"tinyglobby": "^0.2.17"
},
"bin": {
@@ -15108,7 +15108,7 @@
},
"peerDependencies": {
"@types/node": "^20.19.0 || >=22.12.0",
- "@vitejs/devtools": "^0.4.0",
+ "@vitejs/devtools": "^0.4.0 || ^0.5.0",
"esbuild": "^0.27.0 || ^0.28.0",
"jiti": ">=1.21.0",
"less": "^4.0.0",
diff --git a/zeppelin-web-angular/projects/zeppelin-react/package.json
b/zeppelin-web-angular/projects/zeppelin-react/package.json
index bc236a11f2..967698bd41 100644
--- a/zeppelin-web-angular/projects/zeppelin-react/package.json
+++ b/zeppelin-web-angular/projects/zeppelin-react/package.json
@@ -72,7 +72,7 @@
"typescript": "5.9.3",
"typescript-eslint": "^8.33.1",
"unified": "11.0.5",
- "vite": "8.2.1",
+ "vite": "8.2.4",
"vitest": "4.1.11",
"webpack": "5.105.4",
"webpack-cli": "5.1.4",
