Brijesh619 commented on code in PR #703:
URL: https://github.com/apache/atlas/pull/703#discussion_r3841127917
##########
dashboard/package.json:
##########
Review Comment:
axios and vite were already bumped on master. I've updated the PR
description. In my latest commits, I also took a cleaner approach: I removed
the forced overrides block almost entirely. Instead, I bumped our direct
dependencies (react-quill-new to 3.8.3 and recharts to 3.10.1), which naturally
resolves the transitive dependency vulnerabilities. The description is now
accurate.
##########
dashboard/package.json:
##########
@@ -113,11 +113,12 @@
},
"overrides": {
"semver": "7.5.4",
- "minimatch": "9.0.7",
- "brace-expansion": "5.0.6",
"d3-color": "3.1.0",
"lodash": "4.18.1",
"lodash-es": "4.18.1",
- "js-yaml": "4.3.0"
+ "brace-expansion": "5.0.9",
+ "js-yaml": "5.3.0",
Review Comment:
I've actually removed the js-yaml override completely in my latest commit.
By updating our direct dependencies (react-quill-new and recharts), the
transitive dependency vulnerabilities were resolved naturally. Since we are no
longer forcing this major bump via overrides, this is no longer a concern!
##########
dashboard/package.json:
##########
@@ -113,11 +113,12 @@
},
"overrides": {
"semver": "7.5.4",
- "minimatch": "9.0.7",
- "brace-expansion": "5.0.6",
"d3-color": "3.1.0",
"lodash": "4.18.1",
"lodash-es": "4.18.1",
- "js-yaml": "4.3.0"
+ "brace-expansion": "5.0.9",
+ "js-yaml": "5.3.0",
+ "minimatch": "9.0.7",
+ "postcss": "8.5.25"
Review Comment:
Similar to the js-yaml change, I removed the postcss override in the latest
commit. Bumping the direct dependencies fixed the underlying vulnerabilities
organically, so we don't need to force this global override anymore. This
should avoid any potential conflicts with Vite.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
