ASolarers-Rodriguez commented on PR #43406: URL: https://github.com/apache/superset/pull/43406#issuecomment-5375880218
### Testing proof apache/superset isn't Snyk-monitored directly, so this uses npm-native proof instead. All output below is real, captured against the actual PR commit checked out in a local worktree with `.nvmrc`'s Node v24.16.0 / npm 11.13.0. **Before** — `git show upstream/master:superset-frontend/package-lock.json`, every `js-yaml` resolution in the tree: ``` node_modules/cosmiconfig/node_modules/js-yaml => 4.3.0 node_modules/js-yaml => 3.15.0 node_modules/lerna/node_modules/js-yaml => 4.3.0 node_modules/react-diff-viewer-continued/node_modules/js-yaml => 4.3.0 node_modules/stylelint/node_modules/js-yaml => 4.3.0 ``` **After** — `npm ls js-yaml --all` on this PR's commit: ``` [email protected] ├─┬ @istanbuljs/[email protected] │ └─┬ [email protected] │ └─┬ @istanbuljs/[email protected] │ └── [email protected] deduped ├─┬ [email protected] │ └─┬ [email protected] │ └── [email protected] ├─┬ [email protected] │ └── [email protected] ├─┬ [email protected] │ ├─┬ [email protected] │ │ └── [email protected] deduped │ └── [email protected] ├─┬ [email protected] │ └── [email protected] └─┬ [email protected] └─┬ [email protected] └── [email protected] ``` Every instance is now `>= 4.3.1` on the 4.x line or `3.15.1` on the 3.x line — both are the fixed versions per [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj). **Diff scope** — `git diff <merge-base> HEAD --stat`: ``` superset-frontend/package-lock.json | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) ``` Only the lockfile changed; `package.json` is untouched. **Lerna/minimatch smoke check** (the thing #42435 broke by crossing a major-version boundary into `[email protected]`): ``` $ npx eslint --version v10.8.1 $ node -e "const {Minimatch} = require('minimatch'); const mm = new Minimatch('foo{bar,baz}qux'); console.log(mm.braceExpand());" minimatch loaded OK, braceExpand result: [ 'foobarqux', 'foobazqux' ] ``` No `TypeError: expand is not a function` — this PR does not touch that chain. **Not run here:** full `lint-frontend`/`validate-frontend`/unit-test CI — left to CI, will confirm once it reports. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
