JingsongLi commented on PR #10888: URL: https://github.com/apache/paimon/pull/10888#issuecomment-6557455251
Reviewed both lockfile changes (6.1.2 → 6.1.5 and 7.1.1 → 7.1.7), and traced their consumers through Docusaurus/PostCSS/cssnano. They are build-time dependencies of the static documentation site; this repository does not expose selector parsing to requests or user-supplied CSS. The [upstream CPU-exhaustion advisory](https://github.com/advisories/GHSA-rj75-hqrm-r3gf) explicitly scopes exposure to untrusted selector processing and excludes ordinary trusted-source builds. The recursion advisory likewise does not establish a reachable Paimon runtime issue. The upgrade is technically valid: frozen-lockfile installation, both REST OpenAPI contract validations (64 catalog + 10 management operations), and the full Docusaurus production build passed locally; PR CI is green. For this review batch, which requires an end-to-end production or demonstrated current CI outcome, no such outcome has been established for this docs-only dependency bump. Closing under that scope; a follow-up can include an actual reachable exposure or failing build reproduction. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
