jongyoul opened a new pull request, #5257: URL: https://github.com/apache/zeppelin/pull/5257
### What is this PR for? This PR remediates `npm audit` failures in the `zeppelin-react` module (`zeppelin-web-angular/projects/zeppelin-react`) on `master`. ### What changes are proposed? 1. **Upgrade `webpack-dev-server`**: Updated `webpack-dev-server` to `^5.2.4` in `package.json` to resolve the moderate `uuid` and `webpack-dev-server` vulnerabilities. 2. **Add `audit-filter.js`**: Created a custom audit filtering script to handle the `@antv/color-util` and `@antv/adjust` malware false-positives (GHSA-rh6v-hwr4-6jcp / GHSA-qcp2-qp9h-qprg). Npm marked all versions of these packages as malware, causing all audit runs to fail even though the pinned versions in Zeppelin were published years before the compromise. This script filters out those specific advisories while still validating other high/critical security issues. 3. **Update CI Workflow**: Modified `.github/workflows/frontend.yml` to run the custom `audit-filter.js` instead of the raw `npm audit` command. ### How should this be tested? Verify that the `npm-audit` job passes in GitHub Actions. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
