rusackas opened a new pull request, #41289: URL: https://github.com/apache/superset/pull/41289
### SUMMARY Lockfile-only transitive bumps in `superset-frontend` to clear open Dependabot alerts, done via `npm update --package-lock-only` (no `package.json` changes, bumped within existing semver ranges): - **dompurify** 3.4.7 → 3.4.11 — the runtime HTML/XSS sanitizer. Clears the medium ([#1374](https://github.com/apache/superset/security/dependabot/1374)) and two low alerts, and dedupes the nested 3.4.11 copies that were already in the tree. - **http-proxy-middleware** 2.0.9 → 2.0.10 (dev) — clears [#1381](https://github.com/apache/superset/security/dependabot/1381). ### Why not the others (yet) I looked at the rest of the npm/yarn security alerts and intentionally left them out of this PR: - **esbuild** (`superset-frontend`, low/dev) — held at 0.27.x by `storybook` (its range doesn't allow 0.28); bumping needs a forced override that risks breaking Storybook. - **tar** (`superset-frontend`, medium/dev) — pinned exactly to 7.5.11 by `lerna`; needs a scoped override of a build tool's pin. - **js-yaml** (multiple, medium) — most flagged copies are the 3.x line (a different major, not bumpable to the 4.2.0 fix) or 4.1.1 copies pinned by parents; needs overrides. - **@babel/core** (low/dev) — only bumps with large unrelated lockfile churn. - **ws** (`docs/yarn.lock`, "high") — a docs-site build/dev-server dep; the `^7.x` and `^8.x` consumers need different fixed versions and yarn 1 can't scope that cleanly without risk. Low real exposure for a static docs build. Happy to do follow-ups for any of those if we decide the override/churn tradeoff is worth it. ### TESTING INSTRUCTIONS CI (`npm ci` validates the lockfile). No source changes. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
