ASolarers-Rodriguez opened a new pull request, #42583: URL: https://github.com/apache/superset/pull/42583
## Summary Fixes CVE-2026-14257 (brace-expansion regex denial-of-service, GHSA-mh99-v99m-4gvg) for `superset-frontend` with a lockfile-only change: no `package.json` edits. Every dependent in `superset-frontend/package-lock.json` that pulls in `brace-expansion` already declares a caret range (`^1.1.7`, `^2.0.1`/`^2.0.2`, `^5.0.2`/`^5.0.5`) that permits the patched same-major releases. The lockfile was simply pinned to older, vulnerable patch versions. Regenerating the lock (`npm update brace-expansion`) moves every resolution to a patched version with **zero `package.json` diff**: | Location | Before | After | |---|---|---| | `node_modules/brace-expansion` (root) | 1.1.16 | 1.1.17 | | `@jest/reporters` | 2.1.2 | 2.1.3 | | `filelist` | 2.1.2 | 2.1.3 | | `jest-config` | 2.1.2 | 2.1.3 | | `jest-runtime` | 2.1.2 | 2.1.3 | | `@typescript-eslint/typescript-estree` | 5.0.7 | 5.0.8 | | `typescript-json-schema` | 5.0.7 | 5.0.8 | That's 7 of the 19 total `brace-expansion` lock entries; the other 12 were already resolved to a patched version (1.1.17 / 2.1.3 / 5.0.8) before this change. ## Why not `overrides` (superseding #42435) #42435 attempted to fix this with a `package.json` `overrides` block forcing `brace-expansion` to `1.1.17`/`2.1.3`/`5.0.8` globally. That approach broke `lint-frontend`/`validate-frontend` (see [#42435 comment](https://github.com/apache/superset/pull/42435#issuecomment-5113498865)): the root `[email protected]` dependency — pinned by `lerna` and resolved transitively by `eslint-plugin-import` (part of the lint chain) — depends on `brace-expansion@^1.1.7` (the 1.x API). Forcing that resolution to `5.0.8` is a 4-major-version jump whose API no longer matches what `Minimatch.braceExpand` expects, producing `TypeError: expand is not a function`. This PR instead bumps only the resolutions that are actually vulnerable, each staying within its own dependent's existing semver range, so the `[email protected]`/`[email protected]` chain used by lint is untouched (it moves from `1.1.16` to `1.1.17`, both within the same API generation). ## Test plan - [x] `npm update brace-expansion` regenerates the lock with the 7 resolutions above; confirmed zero `package.json` diff (`git diff --stat` shows only `package-lock.json`). - [x] `npx eslint --version` resolves cleanly (`v10.7.0`) after the lockfile change. - [x] Sanity check that the `minimatch`/`brace-expansion` chain still loads and works: `require('minimatch')('src/foo.tsx', 'src/**/*.{ts,tsx}')` returns `true`, and `minimatch.braceExpand('{a,b,c}.js')` returns `['a.js','b.js','c.js']`. - Full `lint-frontend` / `validate-frontend` / test suite left to CI. Advisory: GHSA-mh99-v99m-4gvg CVE: CVE-2026-14257 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
