[
https://issues.apache.org/jira/browse/ATLAS-5348?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Brijesh Bhalala updated ATLAS-5348:
-----------------------------------
Description:
Several frontend transitive dependencies in the Atlas React UI (`/dashboard`)
are outdated and need to be upgraded to their patched versions.
This issue tracks running package updates and adding explicit package overrides
in `package.json` to bump these frontend packages.
*Dependabot PRs Resolved by this Ticket:*
Bump picomatch in /dashboard - [https://github.com/apache/atlas/pull/581]
Bump picomatch in /dashboard/src/views/Lineage/atlas-lineage -
[https://github.com/apache/atlas/pull/580]
Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage -
[https://github.com/apache/atlas/pull/611]
*Upgraded Packages Include:*
> `@babel/core`
> `@tootallnate/once`
> `brace-expansion`
> `form-data`
> `picomatch`
> `ws`
> `yaml`
> `nanoid`
> `js-yaml`
> *`postcss`
was:
Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags
several outdated transitive dependencies that need to be upgraded to their
patched versions.
This issue tracks running `npm audit fix` and adding explicit package overrides
in `package.json` to safely bump these frontend packages.
*Upgraded Packages Include:*
* `@babel/core`
* `@tootallnate/once`
* `brace-expansion` (Override added for `5.0.9`)
* `form-data`
* `picomatch`
* `sanitize-html` (Bumped to `2.17.6`)
* `ws`
* `yaml`
* `nanoid`
* `js-yaml` (Override updated to `5.3.0`)
* `react-router` and `react-router-dom` (Successfully upgraded to `7.18.2`)
* `postcss` (Override added for `8.5.25`)
*Resolution:*
Ran `npm audit fix --force` in the `dashboard` directory and added explicit
overrides in `package.json` to safely bump the affected transitive
dependencies. This included upgrading `react-router` up to `v7.18.2`, which was
verified locally with successful build and type checks.
*Known / Unresolved Issues (1 Remaining):*
After applying all possible updates, `npm audit` reports exactly 1 remaining
item that cannot be safely remediated at this time:
* *quill (=2.0.3):* There is currently 1 low-severity vulnerability flagged
for this package. However, `2.0.3` is currently the latest version available on
npm. There is no patched version available yet, so this cannot be resolved
until the maintainers release a newer update.
> Atlas React UI: Upgrading frontend transitive dependencies
> ----------------------------------------------------------
>
> Key: ATLAS-5348
> URL: https://issues.apache.org/jira/browse/ATLAS-5348
> Project: Atlas
> Issue Type: Task
> Components: atlas-core
> Affects Versions: 2.5.0
> Reporter: Brijesh Bhalala
> Assignee: Brijesh Bhalala
> Priority: Major
> Labels: atlas-react
> Attachments: Screenshot from 2026-08-05 17-35-17.png
>
> Time Spent: 1h 50m
> Remaining Estimate: 0h
>
> Several frontend transitive dependencies in the Atlas React UI (`/dashboard`)
> are outdated and need to be upgraded to their patched versions.
> This issue tracks running package updates and adding explicit package
> overrides in `package.json` to bump these frontend packages.
> *Dependabot PRs Resolved by this Ticket:*
> Bump picomatch in /dashboard - [https://github.com/apache/atlas/pull/581]
> Bump picomatch in /dashboard/src/views/Lineage/atlas-lineage -
> [https://github.com/apache/atlas/pull/580]
> Bump postcss and css-loader in /dashboard/src/views/Lineage/atlas-lineage -
> [https://github.com/apache/atlas/pull/611]
> *Upgraded Packages Include:*
> > `@babel/core`
> > `@tootallnate/once`
> > `brace-expansion`
> > `form-data`
> > `picomatch`
> > `ws`
> > `yaml`
> > `nanoid`
> > `js-yaml`
> > *`postcss`
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
