[ https://issues.apache.org/jira/browse/ATLAS-5348 ]
Brijesh Bhalala deleted comment on ATLAS-5348:
----------------------------------------
was (Author: JIRAUSER294659):
!Screenshot from 2026-08-05 17-35-17.png|width=563,height=287!
We can currently solve 0 of the remaining 3 vulnerabilities without causing
major issues for this PR.
Here is exactly why we can't safely fix them right now:
quill (1 vuln): There is simply no patched version published on npm yet for
this specific advisory
([GHSA-v3m3-f69x-jf25|https://github.com/advisories/GHSA-v3m3-f69x-jf25]). We
are physically unable to fix it until the package maintainers release a patch.
react-router (2 vulns): The security patch was only released in version 7.x.
The dashboard is currently on version 6 (6.30.4). Upgrading from React Router
v6 to v7 is a massive breaking change that would require rewriting the
application's routing logic. A framework migration like that is far too risky
and out-of-scope for a simple dependency-bump PR.
> Atlas React UI: Upgrading frontend transitive dependencies
> ----------------------------------------------------------
>
> Key: ATLAS-5348
> URL: https://issues.apache.org/jira/browse/ATLAS-5348
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
> Attachments: Screenshot from 2026-08-05 17-35-17.png
>
> Time Spent: 1h 20m
> Remaining Estimate: 0h
>
> Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags
> several outdated transitive dependencies that need to be upgraded to their
> patched versions.
> This issue tracks running `npm audit fix` and adding explicit package
> overrides in `package.json` to safely bump these frontend packages.
> *Upgraded Packages Include:*
> * `@babel/core`
> * `@tootallnate/once`
> * `brace-expansion` (Override added for `5.0.9`)
> * `form-data`
> * `picomatch`
> * `sanitize-html` (Bumped to `2.17.6`)
> * `ws`
> * `yaml`
> * `nanoid`
> * `js-yaml` (Override updated to `5.3.0`)
> * `react-router` and `react-router-dom` (Successfully upgraded to `7.18.2`)
> * `postcss` (Override added for `8.5.25`)
> *Resolution:*
> Ran `npm audit fix --force` in the `dashboard` directory and added explicit
> overrides in `package.json` to safely bump the affected transitive
> dependencies. This included upgrading `react-router` up to `v7.18.2`, which
> was verified locally with successful build and type checks.
> *Known / Unresolved Issues (1 Remaining):*
> After applying all possible updates, `npm audit` reports exactly 1 remaining
> item that cannot be safely remediated at this time:
> * *quill (=2.0.3):* There is currently 1 low-severity vulnerability flagged
> for this package. However, `2.0.3` is currently the latest version available
> on npm. There is no patched version available yet, so this cannot be resolved
> until the maintainers release a newer update.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
