[
https://issues.apache.org/jira/browse/ATLAS-5348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5348:
-----------------------------------
Description:
Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags
several outdated transitive dependencies that need to be upgraded to their
patched versions.
This issue tracks running `npm audit fix` and adding explicit package overrides
in `package.json` to bump these frontend packages and resolve the following
warnings:
- **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment
- **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping
- **brace-expansion (4.0.0 - 5.0.8):** High severity DoS vulnerabilities (Fixed
by overriding to `5.0.9`)
- **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped
multipart field names (High Severity)
- **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and
ReDoS vulnerability (High Severity)
- **sanitize-html (1.18.0 - 2.17.4):** Incomplete URI scheme validation (Fixed
by bumping to `2.17.6`)
- **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory exhaustion
DoS (High Severity)
- **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML collections
(Moderate Severity)
**Resolution:**
Ran `npm audit fix` in the `dashboard` directory and added explicit overrides
in `package.json` to safely bump the affected transitive dependencies.
**Known / Unresolved Advisories (3 Remaining):**
- **quill (=2.0.3) (GHSA-v3m3-f69x-jf25):** XSS via HTML export. There is
currently **no patched version** available on npm.
- **react-router / react-router-dom (6.0.0 - 7.17.0):** 2 Moderate
vulnerabilities. The dashboard is currently on `6.30.4` (the highest v6
version). The security patch is only available in `7.18.2`. Upgrading from v6
to v7 is a major breaking architectural change and is out of scope for this
Jira.
- **postcss (<=8.5.22):** The override was bumped to the absolute latest
version available on the registry (`8.5.25`), but the audit may still flag
issues depending on the strictness of the GHSA range until further patches are
officially released.
was:
Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags 8
outdated transitive dependencies that need to be upgraded to their patched
versions.
This issue tracks running `npm audit fix` to automatically bump these frontend
packages in the `package-lock.json` and resolve the following warnings:
- **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment
- **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping
- **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped
multipart field names (High Severity)
- **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and
ReDoS vulnerability (High Severity)
- **postcss (<8.5.10):** XSS via Unescaped `</style>` in CSS Stringify Output
(Moderate Severity)
- **quill (=2.0.3):** XSS via HTML export feature
- **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory exhaustion
DoS (High Severity)
- **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML collections
(Moderate Severity)
**Total:** 8 warnings (3 low, 2 moderate, 3 high)
**Resolution:**
Ran `npm audit fix` in the `dashboard` directory to update the
`package-lock.json` and safely bump all affected transitive dependencies.
> Atlas React UI: Upgrading frontend transitive dependencies
> ----------------------------------------------------------
>
> Key: ATLAS-5348
> URL: https://issues.apache.org/jira/browse/ATLAS-5348
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
> Attachments: Screenshot from 2026-08-05 17-35-17.png
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags
> several outdated transitive dependencies that need to be upgraded to their
> patched versions.
> This issue tracks running `npm audit fix` and adding explicit package
> overrides in `package.json` to bump these frontend packages and resolve the
> following warnings:
> - **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment
> - **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping
> - **brace-expansion (4.0.0 - 5.0.8):** High severity DoS vulnerabilities
> (Fixed by overriding to `5.0.9`)
> - **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped
> multipart field names (High Severity)
> - **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and
> ReDoS vulnerability (High Severity)
> - **sanitize-html (1.18.0 - 2.17.4):** Incomplete URI scheme validation
> (Fixed by bumping to `2.17.6`)
> - **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory
> exhaustion DoS (High Severity)
> - **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML
> collections (Moderate Severity)
> **Resolution:**
> Ran `npm audit fix` in the `dashboard` directory and added explicit overrides
> in `package.json` to safely bump the affected transitive dependencies.
> **Known / Unresolved Advisories (3 Remaining):**
> - **quill (=2.0.3) (GHSA-v3m3-f69x-jf25):** XSS via HTML export. There is
> currently **no patched version** available on npm.
> - **react-router / react-router-dom (6.0.0 - 7.17.0):** 2 Moderate
> vulnerabilities. The dashboard is currently on `6.30.4` (the highest v6
> version). The security patch is only available in `7.18.2`. Upgrading from v6
> to v7 is a major breaking architectural change and is out of scope for this
> Jira.
> - **postcss (<=8.5.22):** The override was bumped to the absolute latest
> version available on the registry (`8.5.25`), but the audit may still flag
> issues depending on the strictness of the GHSA range until further patches
> are officially released.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
