This is an automated email from the ASF dual-hosted git repository.
voidmatcha pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/zeppelin.git
The following commit(s) were added to refs/heads/master by this push:
new 65c12bf1b9 [HOTFIX] Update remaining Node.js toolchains to 22.23.4
65c12bf1b9 is described below
commit 65c12bf1b977dc4e1afdb6fa0934b8376f6abd00
Author: ChanHo Lee <[email protected]>
AuthorDate: Sat Oct 24 23:41:39 2026 +0900
[HOTFIX] Update remaining Node.js toolchains to 22.23.4
### What is this PR for?
Follow up on #5587 by updating the remaining Node.js toolchains to patched
releases. The [October 2026 Node.js security
release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high)
addresses the Brotli decoder vulnerability CVE-2026-111497.
- Upgrade Classic UI builds from Node.js 16.20.2 to 22.23.4, aligning
Maven, nvm, and package engine metadata.
- Upgrade Helium bundle generation from Node.js 16.16.0 to 22.23.4.
- Restrict the Angular/React frontend engine range to patched release
lines: `^22.23.4 || ^24.22.1 || >=26.12.1`.
The existing Classic npm 8.19.4 and Helium npm 8.11.0/Yarn 1.22.0 versions
are retained. Application code and dependency resolutions are unchanged apart
from the Node.js version selection and engine metadata.
Classic uses Node.js during development and builds; Helium also invokes
Node.js on the server to install packages and generate bundles. This updates
those toolchains without claiming a confirmed remotely exploitable Zeppelin
attack path.
### What type of PR is it?
Bug Fix
### Todos
- [x] Validate Classic UI builds and tests on Node.js 22.23.4
- [x] Validate Helium installation, bundle generation, rendering, and cache
reuse
- [x] Validate integration with the #5587 frontend toolchain
- [ ] Confirm GitHub Actions results
### What is the Jira issue?
N/A
### How should this be tested?
Frontend:
- Clean installation with Node.js 22.23.4 and npm 11.21.1.
- React tests: 262 passed.
- React typecheck and React/Angular production builds passed.
- Existing braces security patch applied successfully.
Classic UI:
- Production build and 194 browser unit tests passed.
- Browser checks covered notebook editing, execution, table/chart
rendering, search/replace, and interpreter permission settings.
- The development server connected to the backend successfully.
Helium:
- Five Helium tests passed, and the server reactor build passed with JDK 11.
- Installed and enabled the horizontalbar example, generated its bundle
with Node.js 22.23.4, and verified the SVG chart and values in a notebook.
- On Linux x86-64, verified automatic replacement of an existing Node.js
16.16.0 installation, bundle loading, forced rebuild, and reuse after server
restart.
- The Markdown Spell example installed, bundled, and rendered, but result
persistence encountered an existing Java ClassCastException. Equivalent bundles
built with Node.js 16.20.2 and 22.23.4 were byte-identical.
The browser checks also identified an existing Monaco icon font loading
error, reproduced with a Node.js 22.21.1 comparison build. These existing
issues are outside this change.
The retained Node.js changes are identical to the previously validated
versions. After integration with #5587, installation, React tests, typecheck,
and frontend builds were repeated. The source tree was unchanged by rebasing
onto the merged #5587 commit. The full E2E suite, Storybook build, and final
WAR/container packaging were not rerun.
### Screenshots (if appropriate)
N/A
### Questions:
* Does the license files need to update? No.
* Is there breaking changes for older versions? Builds require a patched
Node.js release. Maven downloads Node.js 22.23.4 for Classic UI builds, and
Helium installs that version for bundle generation.
* Does this needs documentation? Yes; the Classic UI Local Development
instructions now point to the Node.js version pinned in `.nvmrc`.
Closes #5588 from tbonelee/fix/brotli-security-after-5587.
Signed-off-by: YONGJAE LEE <[email protected]>
---
.../src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java | 2 +-
zeppelin-web-angular/package-lock.json | 2 +-
zeppelin-web-angular/package.json | 2 +-
zeppelin-web/.nvmrc | 2 +-
zeppelin-web/README.md | 2 +-
zeppelin-web/package-lock.json | 2 +-
zeppelin-web/package.json | 2 +-
zeppelin-web/pom.xml | 2 +-
8 files changed, 8 insertions(+), 8 deletions(-)
diff --git
a/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java
b/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java
index f6e9389633..7af9bbee78 100644
---
a/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java
+++
b/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java
@@ -70,7 +70,7 @@ import org.slf4j.LoggerFactory;
*/
public class HeliumBundleFactory {
private static final Logger LOGGER =
LoggerFactory.getLogger(HeliumBundleFactory.class);
- private static final String NODE_VERSION = "v16.16.0";
+ private static final String NODE_VERSION = "v22.23.4";
private static final String NPM_VERSION = "8.11.0";
private static final String YARN_VERSION = "v1.22.0";
private static final String NPM_PACKAGE_NAME = "npm";
diff --git a/zeppelin-web-angular/package-lock.json
b/zeppelin-web-angular/package-lock.json
index d59bed52ee..25c0a77f69 100644
--- a/zeppelin-web-angular/package-lock.json
+++ b/zeppelin-web-angular/package-lock.json
@@ -91,7 +91,7 @@
"ws": "8.22.0"
},
"engines": {
- "node": ">=22.12.0"
+ "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
}
},
"node_modules/@algolia/abtesting": {
diff --git a/zeppelin-web-angular/package.json
b/zeppelin-web-angular/package.json
index 67838599f2..9f899297f9 100644
--- a/zeppelin-web-angular/package.json
+++ b/zeppelin-web-angular/package.json
@@ -53,7 +53,7 @@
"e2e:cleanup": "npx tsx e2e/cleanup-util.ts"
},
"engines": {
- "node": ">=22.12.0"
+ "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
},
"private": true,
"dependencies": {
diff --git a/zeppelin-web/.nvmrc b/zeppelin-web/.nvmrc
index 0af7914966..1a5acc8c37 100644
--- a/zeppelin-web/.nvmrc
+++ b/zeppelin-web/.nvmrc
@@ -8,4 +8,4 @@
# See the License for the specific language governing permissions and
# limitations under the License.
-16.20.2
+22.23.4
diff --git a/zeppelin-web/README.md b/zeppelin-web/README.md
index 4023f14d87..ac16f370b8 100644
--- a/zeppelin-web/README.md
+++ b/zeppelin-web/README.md
@@ -6,7 +6,7 @@ This is Zeppelin's frontend project.
### Local Development
-It is recommended to install [Node.js](https://nodejs.org) v16 or use
[creationix/nvm](https://github.com/creationix/nvm).
+Use the [Node.js](https://nodejs.org) version pinned in [.nvmrc](./.nvmrc) for
local development. You can manage this version with
[nvm](https://github.com/nvm-sh/nvm).
All build commands are described in [package.json](./package.json)
diff --git a/zeppelin-web/package-lock.json b/zeppelin-web/package-lock.json
index 78454256ea..704ab376d0 100644
--- a/zeppelin-web/package-lock.json
+++ b/zeppelin-web/package-lock.json
@@ -125,7 +125,7 @@
"webpack-dev-server": "^4.15.2"
},
"engines": {
- "node": "~16.20.2",
+ "node": "~22.23.4",
"npm": "~8.19.4"
}
},
diff --git a/zeppelin-web/package.json b/zeppelin-web/package.json
index 484fe4a431..17c5bdb9c3 100644
--- a/zeppelin-web/package.json
+++ b/zeppelin-web/package.json
@@ -3,7 +3,7 @@
"license": "Apache-2.0",
"version": "0.0.0",
"engines": {
- "node": "~16.20.2",
+ "node": "~22.23.4",
"npm": "~8.19.4"
},
"scripts": {
diff --git a/zeppelin-web/pom.xml b/zeppelin-web/pom.xml
index b929568046..bc05a41f8b 100644
--- a/zeppelin-web/pom.xml
+++ b/zeppelin-web/pom.xml
@@ -38,7 +38,7 @@
<!--plugin versions-->
<plugin.frontend.nodeDownloadRoot>https://nodejs.org/dist/</plugin.frontend.nodeDownloadRoot>
<plugin.frontend.npmDownloadRoot>https://registry.npmjs.org/npm/-/</plugin.frontend.npmDownloadRoot>
- <node.version>v16.20.2</node.version>
+ <node.version>v22.23.4</node.version>
<npm.version>8.19.4</npm.version>
<!-- the scope of the Hadoop dependencies is the same as for the other
Zeppelin components -->
<hadoop.deps.scope>test</hadoop.deps.scope>
