rfellows opened a new pull request, #11878: URL: https://github.com/apache/nifi/pull/11878
# NIFI-16538: Raise the frontend Node floor and clear npm audit highs ## Description `nifi-frontend` still had eight high npm audit findings on the current Angular 21 / Nx 22 toolchain. This raises the Node floor to 24.22.1 and applies direct bumps plus targeted overrides so those highs, and the moderate findings that the same safe upgrades clear, drop out of the audit. Suggested fixes that downgrade Nx, Angular ESLint, or typescript-eslint were left alone. The shipped UI is unchanged. NiFi Registry’s web UI keeps its own Node pin and is not part of this change. ## What's Changed ### nifi-frontend - Raise `engines.node` from `^24.0.0` to `^24.22.1`, and `.tool-versions` from `nodejs 24.14.1` to `nodejs 24.22.1`. - Move Angular build tooling pinned at 21.2.24 to 21.2.29: `@angular-devkit/build-angular`, `@angular-devkit/core`, `@angular-devkit/schematics`, `@angular/build`, `@angular/cli`, `@schematics/angular`. Framework packages stay on 21.2.25, CDK and Material stay on 21.2.14, and `ng-packagr` stays on 21.2.7. - Move `@typescript-eslint/eslint-plugin`, `@typescript-eslint/parser`, and `@typescript-eslint/utils` from 8.57.1 to 8.72.1, and `typescript-eslint` from `^8.40.0` to `^8.72.1`. - Move `happy-dom` from `^20.0.2` to `^21.0.4`, `@eslint/eslintrc` from `^3.3.5` to `^3.3.7`, and `vitest` and `@vitest/coverage-v8` from `^4.1.11` to `^4.1.12`. - Add a direct devDependency on `body-parser` `^2.4.0` so Express 5 (via `@angular/cli` → `@modelcontextprotocol/sdk`) resolves `body-parser` 2.4.0. Express 4 under `webpack-dev-server` still uses nested `body-parser` 1.20.9. - Pin nested `undici` to `^8.12.3` under `@angular/build` and `@module-federation/dts-plugin`. There is no undici 9, so the caret stays on 8. - Add or keep overrides for `nx` (`minimatch` `^9.0.9`, `brace-expansion` `^2.1.4`), `sockjs` `uuid` `^11.1.1`, `webpack-dev-server` `^5.2.6`, `piscina` `^5.3.2`, `vite` `^7.3.7`, `smol-toml` `^1.9.0`, `axios` `^1.20.0`, `follow-redirects` `^1.16.2`, `@modelcontextprotocol/sdk` `^1.32.0`, `node-forge` `^1.4.2`, `qs` `^6.16.2`, `fast-uri` `^3.1.9`, `ip-address` `^10.7.5`, `serialize-javascript` `^7.1.4`, `@eslint/plugin-kit` `^0.7.3`, and `zod` `^4.6.6`. - Remove stale overrides that produced no new advisory when dropped: `http-proxy-middleware`, `compression`, `http-cache-semantics`, `launch-editor`, `postcss-selector-parser`, `proxy-addr`, `shell-quote`, `source-map-js`. - Regenerate `package-lock.json` from those `package.json` changes. - Update `SystemTokensService`’s iframe style-sheet test for happy-dom 21. No production code changed. ### Maven - Root `pom.xml` `node.version` moves from `v24.14.1` to `v24.22.1`. `nifi-frontend` inherits that property. - `nifi-registry` web UI keeps its own `node.version` `v16.13.2` and was not touched. ### Verification Local unsandboxed `nx run-many -t lint,test,build` passed for all six frontend projects: shared 950, nifi 3288, nifi-jolt-transform-ui 122, standard-content-viewer 13, update-attribute 14, nifi-registry 3. CI has not run on this commit. ## Key Features - **Node floor**: `engines`, `.tool-versions`, and the root Maven `node.version` all land on 24.22.1. Registry stays on its own Node 16 pin. - **body-parser**: a direct devDependency feeds Express 5. A flat override was skipped because it would force Express 4 onto body-parser 2.x. - **minimatch under Nx**: the existing `nx` → `minimatch` `^9.0.9` pin stays. Dropping it made Nx resolve minimatch 10 against brace-expansion 2 and fail with `expand is not a function`. - **Rejected downgrades**: `npm audit fix --force` and its dry-run downgrades were not applied. Those included `@nx/[email protected]`, `@[email protected]`, `[email protected]`, and `@module-federation/node` 2.7.52 → 2.7.39. ## Screenshots No UI changes. ## Audit report Baseline before this change: 69 advisories (0 critical, 8 high, 59 moderate, 2 low). After this change: 48 advisories (0 critical, 0 high, 47 moderate, 1 low). Highs cleared: `@angular/cli`, `body-parser`, `follow-redirects` (GHSA-mrwp-f3q8-3g9p), `happy-dom`, `node-forge` (GHSA-86w9-cpqp-85rv, frontend tree only), `nx`, `undici` 7.0.0–7.30.0, `zod` (GHSA-mrhx-c7xc-m3w5). Also cleared with the safe overrides: `qs` (GHSA-6pq8-jhm2-2vcw), `fast-uri` (GHSA-w74x-v6f9-j3xg), `ip-address` (GHSA-rxp7-6hxx-x8q5), `serialize-javascript` (GHSA-m5mm-p8h7-m29v), `vitest` / `@vitest/mocker` (GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp). ## Dependabot | PR | Package | Status | | --- | --- | --- | | [#11848](https://github.com/apache/nifi/pull/11848) | fast-uri 3.1.8 → 3.1.9 in `nifi-frontend` | Satisfied by this change | | [#11846](https://github.com/apache/nifi/pull/11846) | serialize-javascript 7.0.7 → 7.1.4 in `nifi-frontend` | Satisfied by this change | | [#11847](https://github.com/apache/nifi/pull/11847) | happy-dom 20.11.1 → 21.0.4 in `nifi-frontend` | Satisfied by this change | | [#11874](https://github.com/apache/nifi/pull/11874) | node-forge 1.3.1 → 1.4.2 in `nifi-registry` web UI | Not this tree | The frontend override `node-forge` `^1.4.2` does not update the registry package tree, so #11874 is not fixed here. ## Unit test change Only `libs/shared/src/services/system-tokens.service.spec.ts` changed, in `should append style sheet on iframe load`. happy-dom 21 disables iframe page loading, so a real iframe’s `contentDocument` is null and the old test threw (`Failed to load iframe page about:blank`). `appendStyleSheet` only uses `iframe.contentDocument` (create a style element and append it to `head`) and the injected `DOCUMENT` `styleSheets`. The test now builds an HTML document with `document.implementation.createHTMLDocument()` and passes a fake iframe `{ contentDocument }`. It still asserts the same style text. No production code changed. ## Remaining issues The 48 remaining audit entries are three advisories. The other 45 are dependents npm audit counts separately. All three are dev/build tooling, not the shipped UI. npm’s suggested fixes are downgrades (nx 18, `@angular-eslint` 12, typescript-eslint 8.14, eslint 9) and were not taken. 1. **minimatch < 11.0.1**, moderate, GHSA-g3hv-75wg-m249. Twelve copies at 3.1.5, 9.0.9, and 10.2.x. The fix is minimatch >= 11.0.1 with no backport. Parents still request `^3`, `^9`, or `^10` (ESLint 10, typescript-eslint, Nx 22 pinned at 10.2.5 including the override kept here, `@eslint/eslintrc`, editorconfig, glob 10). minimatch 11 drops the callable export, so one override for every copy breaks the v3 and v9 callers. This clears when those parents depend on minimatch 11. This advisory accounts for most of the 48 entries (eslint, nx, `@nx/*`, `@angular-eslint`, typescript-eslint). 2. **glob 10.5.0 and 13.0.6**, moderate, GHSA-3g3m-2fjr-6pw4. Three copies. The fix is glob >= 14.0.2. `@npmcli/package-json` and `cacache` (under `@angular/cli`) want `^13`; `js-beautify` wants `^10`. The only forward fix npm offers is `@angular/[email protected]`, an Angular 22 upgrade. `js-beautify` has no forward fix in the audit data. 3. **deepmerge 4.3.1**, low, GHSA-gcqx-w48m-w2h4. No patched release through 4.3.1. The only consumer is `fork-ts-checker-webpack-plugin` under `@nx/webpack`. npm suggests downgrading Nx to 18. This stays until deepmerge publishes a fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
