JingsongLi commented on PR #10168: URL: https://github.com/apache/paimon/pull/10168#issuecomment-5831747431
Reviewed the one-entry lockfile diff and the published `[email protected]` archive. This update has concrete value: `2.0.2` is affected by the JXL/HEIF and ICNS infinite-loop advisories ([GHSA-5p2g-fcmc-qvqq](https://github.com/advisories/GHSA-5p2g-fcmc-qvqq), [GHSA-w3rx-r6r6-pgpr](https://github.com/advisories/GHSA-w3rx-r6r6-pgpr)). In the `2.0.4` package I verified that `findBox` advances on undersized boxes, JXL partial-stream boxes shorter than 12 bytes are rejected, and ICNS entries shorter than 8 bytes are rejected. The npm package is published by the existing `netroy` maintainer, and its registry integrity matches this lockfile. Local verification on this PR head: `yarn install --frozen-lockfile` passed; `yarn build` passed, including validation of 60 Catalog and 10 Management OpenAPI operations and the optimized Docusaurus client/server build. The PR's CI Documentation/build job is also green. The package now requires Node >=18; the tested docs build environment satisfies that requirement. I found no blocker in this change. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
