LuciferYang opened a new pull request, #57950: URL: https://github.com/apache/spark/pull/57950
### What changes were proposed in this pull request? This clears the high-severity `npm audit` advisories that Dependabot reports against the two npm projects in the repo, `dev` and `ui-test`. All are resolved in range by `npm audit fix --package-lock-only`, so only the two `package-lock.json` files change; no `package.json` and no direct dependency is touched. Package version changes: - `dev`: `fast-uri` 3.1.4 -> 3.1.5, `js-yaml` 4.3.0 -> 4.3.1, `brace-expansion` 1.1.16 -> 1.1.18. - `ui-test`: `js-yaml` 4.3.0 -> 4.3.1, and the several transitive `brace-expansion` copies to their patched releases (5.0.7 -> 5.0.9, 2.1.2 -> 2.1.4 in three trees, 1.1.16 -> 1.1.18). ### Why are the changes needed? `npm audit` reports these high-severity advisories: - `fast-uri` [GHSA-7p8r-x3mc-p8w7](https://github.com/advisories/GHSA-7p8r-x3mc-p8w7) (CVE-2026-18446): host confusion via a backslash authority introducer. `fast-uri` requires a literal `//` to recognize an authority, while Node's WHATWG `URL` treats `\` as interchangeable with `/` for special schemes, so the two parsers extract different hosts from the same input. Fixed in 3.1.5. - `js-yaml` [GHSA-5p4m-2wfm-xmqj](https://github.com/advisories/GHSA-5p4m-2wfm-xmqj): quadratic CPU consumption in `!!omap` resolution. `resolveYamlOmap()` enforces key uniqueness with a linear `indexOf` scan inside the per-element loop, making `yaml.load()` O(n^2) in the number of entries. `!!omap` is in the default schema, so a plain `yaml.load()` is affected. Fixed in 4.3.1. - `brace-expansion` [GHSA-mh99-v99m-4gvg](https://github.com/advisories/GHSA-mh99-v99m-4gvg) and [GHSA-rgw5-rvv9-x895](https://github.com/advisories/GHSA-rgw5-rvv9-x895): DoS via unbounded expansion length and via unbounded intermediate arrays. This addresses https://github.com/apache/spark/security/dependabot/224, https://github.com/apache/spark/security/dependabot/226 and https://github.com/apache/spark/security/dependabot/225. The `brace-expansion` bumps come along with `npm audit fix` rather than being requested separately. Their Dependabot alerts (216-223) are already auto-dismissed on the GitHub side, but `npm audit` still flags them locally, so they are included here to leave the audit clean. These are dev/test-only dependencies, but it is worth keeping the audit clean. ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? Locally, on the commit in this PR: 1. `npm audit` reports `found 0 vulnerabilities` in both projects (before: 3 high in `dev`, 2 high in `ui-test`). 2. `npm ci` reproduces both lockfiles cleanly and leaves them unmodified -- `dev`: `added 112 packages, and audited 113 packages`; `ui-test`: `added 342 packages, and audited 343 packages`. 3. `ui-test` jest suite passes: `Test Suites: 8 passed, 8 total` / `Tests: 22 passed, 22 total`. 4. `dev/lint-js` passes: `lint-js checks passed.` 5. Pass GitHub Actions. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Code (Opus 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
