bito-code-review[bot] commented on code in PR #36918:
URL: https://github.com/apache/superset/pull/36918#discussion_r2663907497
##########
docs/yarn.lock:
##########
@@ -4556,20 +4556,20 @@
tinyglobby "^0.2.15"
ts-api-utils "^2.1.0"
-"@typescript-eslint/[email protected]":
- version "8.51.0"
- resolved
"https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.51.0.tgz#b57f5157d1ac2127bd7c2c9ad8060fa017df4a1a";
- integrity
sha512-1qNjGqFRmlq0VW5iVlcyHBbCjPB7y6SxpBkrbhNWMy/65ZoncXCEPJxkRZL8McrseNH6lFhaxCIaX+vBuFnRng==
- dependencies:
- "@typescript-eslint/project-service" "8.51.0"
- "@typescript-eslint/tsconfig-utils" "8.51.0"
- "@typescript-eslint/types" "8.51.0"
- "@typescript-eslint/visitor-keys" "8.51.0"
- debug "^4.3.4"
- minimatch "^9.0.4"
- semver "^7.6.0"
+"@typescript-eslint/[email protected]":
+ version "8.52.0"
+ resolved
"https://registry.yarnpkg.com/@typescript-eslint/typescript-estree/-/typescript-estree-8.52.0.tgz#2ad7721c671be2127951286cb7f44c4ce55b0591";
+ integrity
sha512-XP3LClsCc0FsTK5/frGjolyADTh3QmsLp6nKd476xNI9CsSsLnmn4f0jrzNoAulmxlmNIpeXuHYeEQv61Q6qeQ==
+ dependencies:
+ "@typescript-eslint/project-service" "8.52.0"
+ "@typescript-eslint/tsconfig-utils" "8.52.0"
+ "@typescript-eslint/types" "8.52.0"
+ "@typescript-eslint/visitor-keys" "8.52.0"
+ debug "^4.4.3"
+ minimatch "^9.0.5"
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>Vulnerable transitive dependency</b></div>
<div id="fix">
The dependency update to minimatch ^9.0.5 maintains a known ReDoS
vulnerability (CVE-2025-5889) in the transitive dependency brace-expansion.
This low-severity issue could potentially impact the docs build if exploited,
though the risk is minimal for documentation. To resolve, consider updating to
@typescript-eslint/typescript-estree versions that use minimatch 10+.
</div>
</div>
<small><i>Code Review Run #0674d9</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a
href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
