[ https://issues.apache.org/jira/browse/FLINK-39516 ]
Purushottam Sinha deleted comment on FLINK-39516:
-------------------------------------------
was (Author: JIRAUSER310845):
Summary
|Severity|Before|After|Resolved|
|----------|------:|------:|---------:|
|Critical| 2| 2| 0|
|High | 30| 16| 14|
|Moderate| 17| 10| 7|
|Low | 6| 3| 3|
|*Total*| *55*| *31*| *24*|
The remaining 31 findings require semver-major upgrades (`npm audit fix
--force`) and are not addressed here.
Resolved Findings
|Severity|Package|Before → After|Advisories|
|----------|---------|----------------|------------|
|high|`@angular/cli`|`20.1.3` → `20.3.24`|*transitive only*|
|high|`@isaacs/brace-expansion`|`5.0.0` →
*removed*|[GHSA-7h2j-956f-4vf2]([https://github.com/advisories/GHSA-7h2j-956f-4vf2])|
|high|`@modelcontextprotocol/sdk`|`1.13.3` →
`1.26.0`|[GHSA-8r9q-7v3j-jr4g]([https://github.com/advisories/GHSA-8r9q-7v3j-jr4g])[GHSA-345p-7cg4-v4c7]([https://github.com/advisories/GHSA-345p-7cg4-v4c7])<br>[GHSA-w48q-cv73-mx4w]([https://github.com/advisories/GHSA-w48q-cv73-mx4w])|
|high|`express`|`4.21.2, 5.1.0` → `4.22.1, 5.2.1`|*transitive only*|
|high|`flatted`|`3.3.2` →
`3.4.2`|[GHSA-25h7-pfq9-p65f]([https://github.com/advisories/GHSA-25h7-pfq9-p65f])[GHSA-rf6f-7fwh-wjgh]([https://github.com/advisories/GHSA-rf6f-7fwh-wjgh])|
|high|`glob`|`10.4.5, 7.2.3` → `13.0.6,
7.2.3`|[GHSA-5j98-mcp5-4vw2]([https://github.com/advisories/GHSA-5j98-mcp5-4vw2])|
|high|`immutable`|`5.1.3` →
`5.1.5`|[GHSA-wf6x-7x77-mvgw]([https://github.com/advisories/GHSA-wf6x-7x77-mvgw])|
|high|`lodash`|`4.17.21` →
`4.18.1`|[GHSA-xxjr-mmjv-4gpg]([https://github.com/advisories/GHSA-xxjr-mmjv-4gpg])<br>[GHSA-r5fr-rjxr-66jc]([https://github.com/advisories/GHSA-r5fr-rjxr-66jc])[GHSA-f23m-r3pf-42rh]([https://github.com/advisories/GHSA-f23m-r3pf-42rh])|
|high|`minimatch`|`10.0.3, 3.1.2, 9.0.5` → `10.2.5, 3.1.5,
9.0.9`|[GHSA-3ppc-4f35-3m26]([https://github.com/advisories/GHSA-3ppc-4f35-3m26])[GHSA-7r86-cg39-jmmj]([https://github.com/advisories/GHSA-7r86-cg39-jmmj])[GHSA-23c5-xmqv-rm74]([https://github.com/advisories/GHSA-23c5-xmqv-rm74])|
|high|`node-forge`|`1.3.1` →
`1.4.0`|[GHSA-554w-wpv2-vw27]([https://github.com/advisories/GHSA-554w-wpv2-vw27])[GHSA-5gfm-wpxj-wjgq]([https://github.com/advisories/GHSA-5gfm-wpxj-wjgq])[GHSA-65ch-62r8-g69g]([https://github.com/advisories/GHSA-65ch-62r8-g69g])[GHSA-2328-f5f3-gj25]([https://github.com/advisories/GHSA-2328-f5f3-gj25])[GHSA-q67f-28xg-22rw]([https://github.com/advisories/GHSA-q67f-28xg-22rw])[GHSA-5m6q-g25r-mvwx]([https://github.com/advisories/GHSA-5m6q-g25r-mvwx])[GHSA-ppp5-5v6c-4jwp]([https://github.com/advisories/GHSA-ppp5-5v6c-4jwp])|
|high|`pacote`|`21.0.0` → `21.0.4`|*transitive only*|
|high|`path-to-regexp`|`0.1.12, 8.2.0` → `0.1.13,
8.4.2`|[GHSA-37ch-88jc-xwx2]([https://github.com/advisories/GHSA-37ch-88jc-xwx2])[GHSA-j3q9-mxjg-w52f]([https://github.com/advisories/GHSA-j3q9-mxjg-w52f])[GHSA-27v5-c462-wpq7]([https://github.com/advisories/GHSA-27v5-c462-wpq7])|
|high|`tar`|`6.2.1, 7.4.3` →
`7.5.13`|[GHSA-34x7-hfp2-rc4v]([https://github.com/advisories/GHSA-34x7-hfp2-rc4v])[GHSA-8qq5-rm4j-mr97]([https://github.com/advisories/GHSA-8qq5-rm4j-mr97][GHSA-83g3-92jg-28cx]([https://github.com/advisories/GHSA-83g3-92jg-28cx])[GHSA-qffp-2rhf-9h96]([https://github.com/advisories/GHSA-qffp-2rhf-9h96])[GHSA-9ppj-qmqm-q256]([https://github.com/advisories/GHSA-9ppj-qmqm-q256])[GHSA-r6q2-hw4h-h46w]([https://github.com/advisories/GHSA-r6q2-hw4h-h46w])|
|high|`terser-webpack-plugin`|`5.3.14` → `5.4.0`|*transitive only*|
|moderate|`@angular-devkit/schematics`|`20.1.3` → `20.3.24`|*transitive only*|
|moderate|`@schematics/angular`|`20.1.3` → `20.3.24`|*transitive only*|
|moderate|`body-parser`|`1.20.3, 2.2.0` → `1.20.4,
2.2.2`|[GHSA-wqch-xfxh-vrr4]([https://github.com/advisories/GHSA-wqch-xfxh-vrr4])|
|moderate|`brace-expansion`|`1.1.11, 2.0.2` → `1.1.14, 2.1.0,
5.0.5`|[GHSA-v6h2-p8h4-qcjw]([https://github.com/advisories/GHSA-v6h2-p8h4-qcjw])<br>[GHSA-f886-m6hf-6m8v]([https://github.com/advisories/GHSA-f886-m6hf-6m8v])|
|moderate|`follow-redirects`|`1.15.9` →
`1.16.0`|[GHSA-r4q5-vmmm-2653]([https://github.com/advisories/GHSA-r4q5-vmmm-2653])|
|moderate|`js-yaml`|`4.1.0` →
`4.1.1`|[GHSA-mh29-5h37-fv8m]([https://github.com/advisories/GHSA-mh29-5h37-fv8m])|
|moderate|`yaml`|`1.10.2, 2.8.0` → `1.10.3,
2.8.3`|[GHSA-48c2-rrv3-qjmp]([https://github.com/advisories/GHSA-48c2-rrv3-qjmp])|
|low|`@inquirer/editor`|`4.2.15` → `4.2.23`|*transitive only*|
|low|`diff`|`4.0.2` →
`4.0.4`|[GHSA-73rr-hh4g-fpgx]([https://github.com/advisories/GHSA-73rr-hh4g-fpgx])|
|low|`external-editor`|`3.1.0` → *removed*|*transitive only*|
> [web dashboard] Address npm security advisories in flink-runtime-web
> web-dashboard
> -----------------------------------------------------------------------------------
>
> Key: FLINK-39516
> URL: https://issues.apache.org/jira/browse/FLINK-39516
> Project: Flink
> Issue Type: Technical Debt
> Components: Runtime / Web Frontend
> Reporter: Purushottam Sinha
> Priority: Minor
> Labels: pull-request-available
>
> {*}Description{*}:
> `npm audit` against flink-runtime-web/web-dashboard currently reports 55
> advisories (2 critical, 30 high, 17 moderate, 6 low). None are in
> runtime-shipped code — the dashboard is a static Angular SPA served by the
> JobManager — but the critical and high findings appear in GHAS/Dependabot
> scans and block clean audit reports for downstream consumers.
>
> *Goal:* Drive the advisory count to zero (or to an explicitly documented
> residual set) without regressing the dashboard build or runtime behavior.
> Approach is split into two phases because the fixes fall into two distinct
> categories:
> 1. SemVer-compatible fixes (lockfile-only): transitives with patches inside
> the currently declared SemVer ranges. Low risk, no package.json churn
> 2. Major-version upgrades (package.json changes): advisories whose patches
> only exist in a new major. Higher risk — touches the Angular framework, the
> Angular build tooling, and the deprecated Protractor subtree pulled in by
> @angular-devkit/build-angular.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
