[
https://issues.apache.org/jira/browse/FLINK-39516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075528#comment-18075528
]
Purushottam Sinha commented on FLINK-39516:
-------------------------------------------
## Summary
| Severity | Before | After | Resolved |
|----------|------:|------:|---------:|
| Critical | 2 | 2 | 0 |
| High | 30 | 16 | 14 |
| Moderate | 17 | 10 | 7 |
| Low | 6 | 3 | 3 |
| **Total** | **55** | **31** | **24** |
The remaining 31 findings require semver-major upgrades (`npm audit fix
--force`) and are not addressed here.
## Resolved Findings
| Severity | Package | Before → After | Advisories |
|----------|---------|----------------|------------|
| high | `@angular/cli` | `20.1.3` → `20.3.24` | *transitive only* |
| high | `@isaacs/brace-expansion` | `5.0.0` → *removed* |
[GHSA-7h2j-956f-4vf2](https://github.com/advisories/GHSA-7h2j-956f-4vf2) |
| high | `@modelcontextprotocol/sdk` | `1.13.3` → `1.26.0` |
[GHSA-8r9q-7v3j-jr4g](https://github.com/advisories/GHSA-8r9q-7v3j-jr4g)<br>[GHSA-345p-7cg4-v4c7](https://github.com/advisories/GHSA-345p-7cg4-v4c7)<br>[GHSA-w48q-cv73-mx4w](https://github.com/advisories/GHSA-w48q-cv73-mx4w)
|
| high | `express` | `4.21.2, 5.1.0` → `4.22.1, 5.2.1` | *transitive only* |
| high | `flatted` | `3.3.2` → `3.4.2` |
[GHSA-25h7-pfq9-p65f](https://github.com/advisories/GHSA-25h7-pfq9-p65f)<br>[GHSA-rf6f-7fwh-wjgh](https://github.com/advisories/GHSA-rf6f-7fwh-wjgh)
|
| high | `glob` | `10.4.5, 7.2.3` → `13.0.6, 7.2.3` |
[GHSA-5j98-mcp5-4vw2](https://github.com/advisories/GHSA-5j98-mcp5-4vw2) |
| high | `immutable` | `5.1.3` → `5.1.5` |
[GHSA-wf6x-7x77-mvgw](https://github.com/advisories/GHSA-wf6x-7x77-mvgw) |
| high | `lodash` | `4.17.21` → `4.18.1` |
[GHSA-xxjr-mmjv-4gpg](https://github.com/advisories/GHSA-xxjr-mmjv-4gpg)<br>[GHSA-r5fr-rjxr-66jc](https://github.com/advisories/GHSA-r5fr-rjxr-66jc)<br>[GHSA-f23m-r3pf-42rh](https://github.com/advisories/GHSA-f23m-r3pf-42rh)
|
| high | `minimatch` | `10.0.3, 3.1.2, 9.0.5` → `10.2.5, 3.1.5, 9.0.9` |
[GHSA-3ppc-4f35-3m26](https://github.com/advisories/GHSA-3ppc-4f35-3m26)<br>[GHSA-7r86-cg39-jmmj](https://github.com/advisories/GHSA-7r86-cg39-jmmj)<br>[GHSA-23c5-xmqv-rm74](https://github.com/advisories/GHSA-23c5-xmqv-rm74)
|
| high | `node-forge` | `1.3.1` → `1.4.0` |
[GHSA-554w-wpv2-vw27](https://github.com/advisories/GHSA-554w-wpv2-vw27)<br>[GHSA-5gfm-wpxj-wjgq](https://github.com/advisories/GHSA-5gfm-wpxj-wjgq)<br>[GHSA-65ch-62r8-g69g](https://github.com/advisories/GHSA-65ch-62r8-g69g)<br>[GHSA-2328-f5f3-gj25](https://github.com/advisories/GHSA-2328-f5f3-gj25)<br>[GHSA-q67f-28xg-22rw](https://github.com/advisories/GHSA-q67f-28xg-22rw)<br>[GHSA-5m6q-g25r-mvwx](https://github.com/advisories/GHSA-5m6q-g25r-mvwx)<br>[GHSA-ppp5-5v6c-4jwp](https://github.com/advisories/GHSA-ppp5-5v6c-4jwp)
|
| high | `pacote` | `21.0.0` → `21.0.4` | *transitive only* |
| high | `path-to-regexp` | `0.1.12, 8.2.0` → `0.1.13, 8.4.2` |
[GHSA-37ch-88jc-xwx2](https://github.com/advisories/GHSA-37ch-88jc-xwx2)<br>[GHSA-j3q9-mxjg-w52f](https://github.com/advisories/GHSA-j3q9-mxjg-w52f)<br>[GHSA-27v5-c462-wpq7](https://github.com/advisories/GHSA-27v5-c462-wpq7)
|
| high | `tar` | `6.2.1, 7.4.3` → `7.5.13` |
[GHSA-34x7-hfp2-rc4v](https://github.com/advisories/GHSA-34x7-hfp2-rc4v)<br>[GHSA-8qq5-rm4j-mr97](https://github.com/advisories/GHSA-8qq5-rm4j-mr97)<br>[GHSA-83g3-92jg-28cx](https://github.com/advisories/GHSA-83g3-92jg-28cx)<br>[GHSA-qffp-2rhf-9h96](https://github.com/advisories/GHSA-qffp-2rhf-9h96)<br>[GHSA-9ppj-qmqm-q256](https://github.com/advisories/GHSA-9ppj-qmqm-q256)<br>[GHSA-r6q2-hw4h-h46w](https://github.com/advisories/GHSA-r6q2-hw4h-h46w)
|
| high | `terser-webpack-plugin` | `5.3.14` → `5.4.0` | *transitive only* |
| moderate | `@angular-devkit/schematics` | `20.1.3` → `20.3.24` | *transitive
only* |
| moderate | `@schematics/angular` | `20.1.3` → `20.3.24` | *transitive only* |
| moderate | `body-parser` | `1.20.3, 2.2.0` → `1.20.4, 2.2.2` |
[GHSA-wqch-xfxh-vrr4](https://github.com/advisories/GHSA-wqch-xfxh-vrr4) |
| moderate | `brace-expansion` | `1.1.11, 2.0.2` → `1.1.14, 2.1.0, 5.0.5` |
[GHSA-v6h2-p8h4-qcjw](https://github.com/advisories/GHSA-v6h2-p8h4-qcjw)<br>[GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v)
|
| moderate | `follow-redirects` | `1.15.9` → `1.16.0` |
[GHSA-r4q5-vmmm-2653](https://github.com/advisories/GHSA-r4q5-vmmm-2653) |
| moderate | `js-yaml` | `4.1.0` → `4.1.1` |
[GHSA-mh29-5h37-fv8m](https://github.com/advisories/GHSA-mh29-5h37-fv8m) |
| moderate | `yaml` | `1.10.2, 2.8.0` → `1.10.3, 2.8.3` |
[GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp) |
| low | `@inquirer/editor` | `4.2.15` → `4.2.23` | *transitive only* |
| low | `diff` | `4.0.2` → `4.0.4` |
[GHSA-73rr-hh4g-fpgx](https://github.com/advisories/GHSA-73rr-hh4g-fpgx) |
| low | `external-editor` | `3.1.0` → *removed* | *transitive only* |
> [web dashboard] Address npm security advisories in flink-runtime-web
> web-dashboard
> -----------------------------------------------------------------------------------
>
> Key: FLINK-39516
> URL: https://issues.apache.org/jira/browse/FLINK-39516
> Project: Flink
> Issue Type: Technical Debt
> Components: Runtime / Web Frontend
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> {*}Description{*}:
> `npm audit` against flink-runtime-web/web-dashboard currently reports 55
> advisories (2 critical, 30 high, 17 moderate, 6 low). None are in
> runtime-shipped code — the dashboard is a static Angular SPA served by the
> JobManager — but the critical and high findings appear in GHAS/Dependabot
> scans and block clean audit reports for downstream consumers.
>
> *Goal:* Drive the advisory count to zero (or to an explicitly documented
> residual set) without regressing the dashboard build or runtime behavior.
> Approach is split into two phases because the fixes fall into two distinct
> categories:
> 1. SemVer-compatible fixes (lockfile-only): transitives with patches inside
> the currently declared SemVer ranges. Low risk, no package.json churn
> 2. Major-version upgrades (package.json changes): advisories whose patches
> only exist in a new major. Higher risk — touches the Angular framework, the
> Angular build tooling, and the deprecated Protractor subtree pulled in by
> @angular-devkit/build-angular.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
