rusackas opened a new pull request, #43664: URL: https://github.com/apache/superset/pull/43664
### SUMMARY Patches three DoS/ReDoS vulnerabilities in `superset-frontend/cypress-base`, all transitive dependencies of E2E test tooling (not shipped application code): - **js-yaml 4.1.1 → 4.3.1** — quadratic-CPU DoS via YAML merge-key chains and `!!omap` resolution. Pulled in transitively by `@cypress/code-coverage`; an existing override was already pinning this package, just needed the version bumped. Closes #1512, #1434, #1387. - **brace-expansion 1.1.16 → 1.1.18** (two nested instances, under `glob`'s and `test-exclude`'s bundled `minimatch@<10`) — unbounded expansion-length / intermediate-array DoS. The parent's declared `^1.1.7` range already permitted 1.1.18; added a scoped override mirroring the repo's existing `minimatch@>=10` one so both minimatch generations resolve a safe brace-expansion. Closes #1485, #1480. - **d3-color 1.4.1 → 3.1.0** — ReDoS in color-string parsing. `d3-interpolate` (the only consumer here) declares peer support for `d3-color: 1 - 3`, so the major bump is within its own compatibility contract. Closes #1474. **Left untouched:** `extract-zip` (alert #1526, same manifest) has no patched version published upstream yet (npm `latest` is still `2.0.1`, the vulnerable version) — it's used internally by `cypress` only to unpack its own downloaded binary during install, not to process untrusted input. Nothing to bump; flagging separately rather than opening a no-op PR for it. ### TESTING INSTRUCTIONS Dependency-only change to E2E tooling, no application source touched, so no new test is added — the existing Cypress/CI suite is the regression check. Verified locally via `npm install --package-lock-only` that all three packages resolve to patched versions everywhere in the tree (`npm ls js-yaml`, `npm ls brace-expansion`, `npm ls d3-color`), and `npm audit` no longer flags any of the three (only the known-unfixable `extract-zip` chain remains). ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
