[
https://issues.apache.org/jira/browse/FLINK-39518?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Purushottam Sinha updated FLINK-39518:
--------------------------------------
Description:
{{npm audit}} in {{flink-runtime-web/web-dashboard}} reports 55
advisories (2 Critical, 30 High, 17 Moderate, 6 Low) as of 2026-04-22.
All findings are in dev/build tooling — none ship in the runtime —
but they show up in downstream {{npm audit}} runs and block release
sign-off for packagers.
Goal: drive {{npm audit}} to zero without breaking build, lint, or the
dashboard.
Split by risk:
* FLINK-39517 — lockfile-only fixes ({{npm audit fix}}, no major bumps)
* FLINK-39518 — SemVer-major upgrades for the rest
was:
*Description*:
After FLINK-XXXXX (SemVer-compatible audit fix), ~31 advisories will remain in
flink-runtime-web/web-dashboard — including two critical (form-data, request).
Their patched versions live outside the currently declared SemVer ranges, so
clearing them requires major-version upgrades to package.json.
The remaining advisories cluster into three dependency subtrees.
Address each as a separate PR so a build regression can be bisected:
1. Protractor subtree (critical + high + moderate)
Packages: form-data, request, qs, tough-cookie, xml2js, tmp,
selenium-webdriver, webdriver-manager, webdriver-js-extender.
Root cause: all pulled transitively via @angular-devkit/build-angular →
protractor. Protractor is deprecated by Angular and unused in this project (no
e2e/, no protractor.conf, no e2e npm script).
Options to evaluate:
(a) Migrate the builder from @angular-devkit/build-angular to
@angular/build (modern esbuild pipeline), which drops the entire subtree.
(b) Add `overrides` in package.json to patch the leaf libs in place.
2. Angular framework (high)
Packages: @angular/{core, common, compiler, animations,
forms,platform-browser, platform-browser-dynamic, router}. All currently
on 20.1.x; patches live in 20.3.16+ or Angular 21. Bump the @angular/*
packages together with a matching @angular/cli and compiler-cli bump.
3. Build tooling (high + moderate)
Packages: @angular-devkit/*, @angular/build, webpack, vite, rollup,
picomatch, serialize-javascript, copy-webpack-plugin, ajv. Moves as a unit with
the Angular CLI major bump.
Suggested sequence: (1) → (2) → (3).
*Acceptance per PR:*
- `npm audit` no longer reports advisories in that subtree
- `npm run build` and `npm run lint` pass
- Dashboard renders and exercises basic flows (job list, job detail,
task manager list) in a browser against a running JobManager
> Upgrade web-dashboard dependencies to major remaining npm advisories
> --------------------------------------------------------------------
>
> Key: FLINK-39518
> URL: https://issues.apache.org/jira/browse/FLINK-39518
> Project: Flink
> Issue Type: Sub-task
> Components: Runtime / Web Frontend
> Reporter: Purushottam Sinha
> Priority: Minor
> Attachments: DEPENDENCY_UPGRADES.md
>
>
> {{npm audit}} in {{flink-runtime-web/web-dashboard}} reports 55
>
>
> advisories (2 Critical, 30 High, 17 Moderate, 6 Low) as of 2026-04-22.
>
>
>
>
>
> All findings are in dev/build tooling — none ship in the runtime —
>
>
> but they show up in downstream {{npm audit}} runs and block release
>
>
> sign-off for packagers.
>
>
>
> Goal: drive {{npm audit}} to zero without breaking build, lint, or the
>
>
> dashboard.
>
>
>
> Split by risk:
> * FLINK-39517 — lockfile-only fixes ({{npm audit fix}}, no major bumps)
> * FLINK-39518 — SemVer-major upgrades for the rest
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
