voidmatcha opened a new pull request, #5278:
URL: https://github.com/apache/zeppelin/pull/5278
### What is this PR for?
`npm audit --audit-level=high` fails on master, so every frontend PR's
npm-audit
job goes red. Two high-severity advisories in zeppelin-react's dependency
tree:
- **linkify-it** 3.0.3 (via ansi-to-react): GHSA-22p9-wv53-3rq4. Pinned to
`^5.0.2`.
- **undici** 7.27.0 (via jsdom): GHSA-vmh5-mc38-953g and related. Pinned to
`7.28.0`, the highest stable 7.x, which satisfies jsdom's `^7.25.0`.
Both use `overrides`. `npm audit fix --force` was avoided because it
downgrades
ansi-to-react.
The linkify-it 3 to 5 bump needs no source changes. No project code imports
linkify-it, and its only consumer (ansi-to-react) calls `.tlds()`,
`.pretest()`,
and `.match()`, which are unchanged from v3 through v5. The override
deliberately
crosses ansi-to-react's declared `^3.0.3` range, and can be revisited if
ansi-to-react is updated.
### What type of PR is it?
Improvement
### What is the Jira issue?
N/A
### How should this be tested?
* `cd zeppelin-web-angular/projects/zeppelin-react && npm ci && npm audit
--audit-level=high` exits 0.
* `npm run lint`, `npm test` (vitest), and `npm run build` pass.
* ansi-to-react still renders URLs as links with linkify-it 5.
### Questions:
* Does the license files need to update? No.
* Is there breaking changes for older versions? No.
* Does this needs documentation? No.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
