rfellows opened a new pull request, #11508: URL: https://github.com/apache/nifi/pull/11508
[NIFI-16169](https://issues.apache.org/jira/browse/NIFI-16169) — *UI - Address dependabot and other security related dependency issues* ## Summary | Metric | Before | After | | --------- | ------ | ----- | | Critical | 0 | 0 | | High | 14 | 0 | | Moderate | 15 | 0 | | Low | 0 | 0 | | **Total** | **29** | **0** | **Target:** `nifi-frontend/src/main/frontend/` **Node:** v24.14.1 · **npm:** 11.11.0 `npm audit` now reports **0 vulnerabilities**. Fixes landed via a mix of Nx-native framework migrations, direct dependency bumps, and a slimmed-down, verified `overrides` block. ## Dependabot Alert Cross-Reference Cross-referenced against the **live open Dependabot alerts** for manifest `nifi-frontend/src/main/frontend/package-lock.json` ([alerts view](https://github.com/apache/nifi/security/dependabot?q=is%3Aopen+manifest%3Anifi-frontend%2Fsrc%2Fmain%2Ffrontend%2Fpackage-lock.json)), captured 2026-08-04: **18 open alerts (8 High, 10 Moderate)**. All are resolved by this pass and will auto-close once the updated `package.json` / `package-lock.json` merge to the default branch. "Resolution" legend: **Fixed** = advisory suppressed by an upgrade or override; **No longer applicable** = the regenerated dependency graph resolves a patched version on its own (no override required). ### High (8) | Alert | Package | GHSA | Resolution | Mechanism | | --- | --- | --- | --- | --- | | [#842](https://github.com/apache/nifi/security/dependabot/842) | `@angular/common` | [GHSA-jhpw-976m-542j](https://github.com/advisories/GHSA-jhpw-976m-542j) | ✅ Fixed | Angular `21.2.17 → 21.2.19` (`nx migrate`) | | [#847](https://github.com/apache/nifi/security/dependabot/847) | `@angular/core` | [GHSA-jj27-h5hq-8x99](https://github.com/advisories/GHSA-jj27-h5hq-8x99) | ✅ Fixed | Angular `21.2.17 → 21.2.19` (`nx migrate`) | | [#845](https://github.com/apache/nifi/security/dependabot/845) | `@angular/compiler` | [GHSA-jj27-h5hq-8x99](https://github.com/advisories/GHSA-jj27-h5hq-8x99) | ✅ Fixed | Angular `21.2.17 → 21.2.19` (`nx migrate`) | | [#829](https://github.com/apache/nifi/security/dependabot/829) | `postcss` | [GHSA-r28c-9q8g-f849](https://github.com/advisories/GHSA-r28c-9q8g-f849) | ✅ Fixed | `postcss → ^8.5.25` (direct dep + nested `@angular-devkit/build-angular` override) | | [#839](https://github.com/apache/nifi/security/dependabot/839) | `brace-expansion` | [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg) | ✅ Fixed | Per-parent nested overrides (`1.1.18` / `2.1.4` / `5.0.9`) | | [#852](https://github.com/apache/nifi/security/dependabot/852) | `undici` | [GHSA-4cwx-7wf7-3272](https://github.com/advisories/GHSA-4cwx-7wf7-3272) | ✅ Fixed | `undici → ^8.10.0` (fix at 8.9.0) | | [#851](https://github.com/apache/nifi/security/dependabot/851) | `fast-uri` | [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7) | ✅ No longer applicable | Tree resolves `[email protected]` (patched); override removed | | [#830](https://github.com/apache/nifi/security/dependabot/830) | `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) | ✅ No longer applicable | Tree resolves `[email protected]` (patched); override removed | ### Moderate (10) | Alert | Package | GHSA | Resolution | Mechanism | | --- | --- | --- | --- | --- | | [#836](https://github.com/apache/nifi/security/dependabot/836) | `nx` | [GHSA-g2r8-wvmj-jf5w](https://github.com/advisories/GHSA-g2r8-wvmj-jf5w) | ✅ Fixed | Nx `22.5.4 → 22.7.8` (`nx migrate`) | | [#814](https://github.com/apache/nifi/security/dependabot/814) | `@hono/node-server` | [GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9) | ✅ Fixed | `@hono/node-server → ^2.0.5` (resolved `2.0.12`) + `@modelcontextprotocol/sdk → ^1.30.0` | | [#808](https://github.com/apache/nifi/security/dependabot/808) | `webpack-dev-server` | [GHSA-m28w-2pqf-7qgj](https://github.com/advisories/GHSA-m28w-2pqf-7qgj) | ✅ Fixed | `webpack-dev-server → ^5.2.6` (also targeted by PR #11466) | | [#809](https://github.com/apache/nifi/security/dependabot/809) | `webpack-dev-server` | [GHSA-f5vj-f2hx-8m93](https://github.com/advisories/GHSA-f5vj-f2hx-8m93) | ✅ Fixed | `webpack-dev-server → ^5.2.6` (also targeted by PR #11466) | | [#853](https://github.com/apache/nifi/security/dependabot/853) | `undici` | [GHSA-8xcm-r25x-g524](https://github.com/advisories/GHSA-8xcm-r25x-g524) | ✅ Fixed | `undici → ^8.10.0` (fix at 8.9.0) | | [#854](https://github.com/apache/nifi/security/dependabot/854) | `undici` | [GHSA-v3r7-h72x-cjcm](https://github.com/advisories/GHSA-v3r7-h72x-cjcm) | ✅ Fixed | `undici → ^8.10.0` (fix at 8.9.0) | | [#855](https://github.com/apache/nifi/security/dependabot/855) | `undici` | [GHSA-jr45-8vmc-qm54](https://github.com/advisories/GHSA-jr45-8vmc-qm54) | ✅ Fixed | `undici → ^8.10.0` (fix at 8.9.0) | | [#856](https://github.com/apache/nifi/security/dependabot/856) | `undici` | [GHSA-m8rv-5g2x-5cg5](https://github.com/advisories/GHSA-m8rv-5g2x-5cg5) | ✅ Fixed | `undici → ^8.10.0` (fix at 8.9.0) | | [#857](https://github.com/apache/nifi/security/dependabot/857) | `ip-address` | [GHSA-22jq-vg5j-6vgg](https://github.com/advisories/GHSA-22jq-vg5j-6vgg) | ✅ No longer applicable | Tree resolves `[email protected]` (fix at 10.2.1); no override needed | | [#858](https://github.com/apache/nifi/security/dependabot/858) | `ip-address` | [GHSA-4xrf-jv44-h6hh](https://github.com/advisories/GHSA-4xrf-jv44-h6hh) | ✅ No longer applicable | Tree resolves `[email protected]` (fix at 10.2.2); no override needed | **18 alerts → all resolved.** 13 are Fixed via upgrade/override; 4 are No longer applicable (`fast-uri`, `js-yaml`, and both `ip-address` alerts) because the regenerated lockfile already resolves patched versions without an override. > **Note on counts:** the live Dependabot list (18 alerts, captured after several advisories were published in the ~24h before > this pass) is larger than the initial baseline `npm audit` (29 advisory rows, but only 14 unique GHSAs at that snapshot). The > extra alerts — the 3 newest `undici` moderates and both `ip-address` moderates — were published after the baseline snapshot; > they are all still covered by the `undici` override bump and the lockfile regeneration respectively. A fresh `npm audit` > against the current tree confirms **0 vulnerabilities**. ### Related PR Dependabot alerts #808 / #809 both reference PR [#11466](https://github.com/apache/nifi/pull/11466), an existing `webpack-dev-server` bump. The `webpack-dev-server → ^5.2.6` override in this pass supersedes it; that PR can be closed once this work merges. ## Actions Taken (chronological) ### 1. Transitive overrides — bumped ineffective pins & added new ones - `undici` `>=7.28.0 → ^8.10.0`; `js-yaml` `>=4.3.0 → ^5.2.3` (later removed, see prune); `fast-uri` `>=3.1.4 → ^4.1.2` (later removed); `webpack-dev-server` `>=5.2.5 → ^5.2.6`; `postcss` direct dep `^8.5.10 → ^8.5.25` + nested `@angular-devkit/build-angular` override. - New: `brace-expansion` (nested per parent — flat `^5.0.9` broke Nx, which relies on the pre-5.x default-export API), `@hono/node-server ^2.0.5`, `@modelcontextprotocol/sdk ^1.30.0`. - Removed 13 stale overrides that no longer suppressed any advisory (`flatted`, `lodash-es`, `tar`, `websocket-driver`, `axios`, `immutable`, `shell-quote`, `svgo`, `hono`, `body-parser`, `dompurify`, `rollup`, top-level `ajv`). ### 2. Framework bumps via Nx-native tooling (approved) - **Nx `22.5.4 → 22.7.8`** — `npx nx migrate 22.7.8` → `npx nx migrate --run-migrations`. Migrations were benign: 4 `.gitignore`/`.prettierignore` additions and one `@nx/eslint:lint` executor-input update in `nx.json`. Resolved all 10 Nx-family alerts. - **Angular `21.2.17 → 21.2.19`** — `npx nx migrate @angular/[email protected]` (patch bump, no code migrations). `ng update` is unavailable in this Nx-native workspace (no `angular.json`). Resolved all 9 Angular alerts, including the two production-facing XSS / cache-poisoning issues. - Regenerated `package-lock.json` (clean reinstall) to clear a transient peer-dep state after the coordinated Angular bump. - Pinned `prettier ~3.8.3` — the clean reinstall drifted prettier `3.8.3 → 3.9.6` within its `^3.2.5` range, and 3.9 reformats short type unions, flagging two pre-existing files. Pinning avoids unrelated formatting churn in a security PR. ### 3. Overrides prune (tidy-up) Batch prune (clear `overrides`, reinstall, re-audit → 40 advisories surface) confirmed which entries are load-bearing. Removed 8 now-stale entries; kept 17. Net: **25 → 17** override keys. - Removed: `koa` (not in tree), `js-yaml` (natural `4.3.1`), `fast-uri` (natural `3.1.5`), `ws` (natural `8.21.2`), `adm-zip` (natural `0.6.0`), and the three `*.ajv` nested pins (natural resolution already supplies eslint's ajv 6.x). - **Kept for API-compat (not security):** `nx.minimatch ^9.0.9` and `@nx/devkit.minimatch ^9.0.9`. Dropping them let `[email protected]` in, whose ESM entry does `import { expand } from 'brace-expansion'` — a named export absent from the `[email protected]` we pin under nx, breaking Nx at runtime (`brace_expansion_1.expand is not a function`). ## Final `overrides` block (17 keys) ```json "overrides": { "eslint": { "brace-expansion": "^5.0.9" }, "@eslint/eslintrc": { "brace-expansion": "^1.1.18" }, "serialize-javascript": "^7.0.3", "nx": { "minimatch": "^9.0.9", "brace-expansion": "^2.1.4" }, "@nx/devkit": { "minimatch": "^9.0.9", "brace-expansion": "^2.1.4" }, "@nx/angular": { "brace-expansion": "^2.1.4" }, "@angular/cli": { "brace-expansion": "^5.0.9" }, "@typescript-eslint/parser": { "brace-expansion": "^5.0.9" }, "undici": "^8.10.0", "picomatch": "^4.0.4", "@babel/core": "^7.29.7", "sockjs": { "uuid": "^11.1.1" }, "@angular-devkit/build-angular": { "postcss": "^8.5.25" }, "webpack-dev-server": "^5.2.6", "http-proxy-middleware": "^3.0.7", "piscina": "^5.2.0", "vite": "^7.3.5", "@hono/node-server": "^2.0.5", "@modelcontextprotocol/sdk": "^1.30.0" } ``` ## Files Changed | File | Change | | --- | --- | | `package.json` | Angular 9 deps → 21.2.19; Nx 4 devDeps → 22.7.8; `postcss → ^8.5.25`; `prettier → ~3.8.3`; overrides rewritten (25 → 17) | | `package-lock.json` | Regenerated | | `nx.json` | `@nx/eslint:lint` inputs (from `nx migrate`) | | `.gitignore`, `.prettierignore` | `.nx/*` and `.claude/*` entries (from `nx migrate`) | ## Verification `cd nifi-frontend/src/main/frontend && npx nx run-many -t lint,test,build --parallel=3 --skip-nx-cache` - **lint** — 6 projects — ✔ pass - **test** — 6 projects — 325 test files, 2748 tests passed - **build** — 6 projects — bundle generation complete - **`npm audit`** — **0 vulnerabilities** -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
