ASolarers-Rodriguez commented on PR #42583: URL: https://github.com/apache/superset/pull/42583#issuecomment-5124499502
Verified this locally against the resolved `superset-frontend` tree (Node v24.16.0 per `.nvmrc`), addressing GHSA-mh99-v99m-4gvg / CVE-2026-14257 (DoS via unbounded expansion length; fixed per major line at brace-expansion 1.1.17 / 2.1.3 / 5.0.8, per the npm registry publish history): `npm ls brace-expansion --all` — every resolved instance across the dependency tree is at a patched version, none below: ``` $ npm ls brace-expansion --all 2>/dev/null | grep -oE 'brace-expansion@[0-9.]+' | sort -u [email protected] [email protected] [email protected] ``` `git diff` against the merge-base confirms this is a lockfile-only change: ``` $ git diff <merge-base> HEAD --stat superset-frontend/package-lock.json | 46 ++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 23 deletions(-) ``` Before contrast (`upstream/master:superset-frontend/package-lock.json`) shows the old vulnerable pins this PR replaces: ``` node_modules/brace-expansion: 1.1.16 .../node_modules/brace-expansion: 2.1.2 (multiple nested instances) .../node_modules/brace-expansion: 5.0.7 (multiple nested instances) ``` All post-bump instances land on 1.1.17 / 2.1.3 / 5.0.8, matching the fixed versions in the advisory. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
