chore(deps): bump vulnerable transitive deps across lockfiles#41307
Open
rusackas wants to merge 1 commit into
Open
chore(deps): bump vulnerable transitive deps across lockfiles#41307rusackas wants to merge 1 commit into
rusackas wants to merge 1 commit into
Conversation
Resolves several Dependabot security alerts by pinning patched versions of transitive dependencies via npm `overrides` / yarn `resolutions`. superset-frontend (package-lock.json): - dompurify -> 3.4.11 (GHSA-cmwh-pvxp-8882, -vxr8-fq34-vvx9, -gvmj-g25r-r7wr) - esbuild -> 0.28.1 (GHSA-g7r4-m6w7-qqqr) - http-proxy-middleware -> 2.0.10 (GHSA-64mm-vxmg-q3vj) - tar -> 7.5.16 (GHSA-vmf3-w455-68vh) docs (yarn.lock): - ws -> 8.21.0 (GHSA-96hv-2xvq-fx4p, two HIGH alerts; 7.x and 8.x consumers) superset-websocket (package-lock.json): - @babel/core -> 7.29.7 (GHSA-4x5r-pxfx-6jf8) superset-frontend/cypress-base (package-lock.json): - @babel/core -> 7.29.7 (GHSA-4x5r-pxfx-6jf8) js-yaml (GHSA-h67p-54hq-rp68) is intentionally NOT bumped: the only patched release is 4.2.0, but the remaining vulnerable instance is js-yaml@3.14.2 pulled in by @istanbuljs/load-nyc-config (jest coverage tooling) which uses the v3 API removed in v4. Forcing v4 would break the build; it needs upstream consumer upgrades and is tracked separately. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
rusackas
requested review from
betodealmeida,
eschutho,
geido,
mistercrunch and
sadpandajoe
as code owners
github-actions
Bot
added
doc
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![bito-code-review[bot]](https://avatars.githubusercontent.com/in/1061978?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review Agent Run #531d4e
Actionable Suggestions - 1
-
docs/yarn.lock - 1
- Manual lock file edit violation · Line 15249-15255
Review Details
-
Files reviewed - 1 · Commit Range:
959ad67..959ad67- docs/yarn.lock
-
Files skipped - 7
- docs/package.json - Reason: Filter setting
- superset-frontend/cypress-base/package-lock.json - Reason: Filter setting
- superset-frontend/cypress-base/package.json - Reason: Filter setting
- superset-frontend/package-lock.json - Reason: Filter setting
- superset-frontend/package.json - Reason: Filter setting
- superset-websocket/package-lock.json - Reason: Filter setting
- superset-websocket/package.json - Reason: Filter setting
-
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
Bito Usage Guide
Commands
Type the following command in the pull request comment and save the comment.
-
/review- Manually triggers a full AI review. -
/pause- Pauses automatic reviews on this pull request. -
/resume- Resumes automatic reviews. -
/resolve- Marks all Bito-posted review comments as resolved. -
/abort- Cancels all in-progress reviews.
Refer to the documentation for additional commands.
Configuration
This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.
Documentation & Help
AI Code Review powered by
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #41307 +/- ##
=======================================
Coverage 64.34% 64.34%
=======================================
Files 2653 2653
Lines 144952 144952
Branches 33433 33433
=======================================
Hits 93273 93273
Misses 49995 49995
Partials 1684 1684
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Clears a batch of open Dependabot security alerts for transitive npm/yarn dependencies by pinning patched versions via npm
overrides/ yarnresolutions. No direct/runtime API changes — all bumps are same-major (exceptwsfor one dev-only consumer, see below) and the lockfiles are regenerated with the repo's pinned toolchain (node 24 / npm 11 / yarn 1.22).Alerts addressed (10 of the 16 open npm/yarn alerts):
superset-frontend/package-lock.jsondocs/yarn.locksuperset-websocket/package-lock.jsonsuperset-frontend/cypress-base/package-lock.jsonNotes / deliberate decisions:
js-yaml(GHSA-h67p-54hq-rp68) is intentionally left out. The only patched release is4.2.0, but the remaining vulnerable instance everywhere isjs-yaml@3.14.2, pulled in by@istanbuljs/load-nyc-config(jest coverage tooling) which relies on the v3 API (safeLoad) removed in v4. Forcing v4 globally breaks the build. It needs upstream consumer upgrades and is better handled separately. This also leavessuperset-embedded-sdk(js-yaml-only) untouched.docsws: yarn classic (1.22) can only force a single version globally, so allwsconsumers (storybook, webpack-dev-server, and webpack-bundle-analyzer) move to8.21.0. webpack-bundle-analyzer's declared range was^7.3.1, but it's a dev-only tool used only in optionalanalyzemode and itsWebSocket.Serverusage is compatible across ws 7→8.TESTING INSTRUCTIONS
Lockfile-only changes; CI exercises the affected toolchains. Locally:
cd superset-frontend && npm ci && npm run build/npm run testcd superset-websocket && npm ci && npm run testcd docs && yarn install && yarn buildAfter merge, the listed Dependabot alerts should auto-close.
ADDITIONAL INFORMATION
🤖 Generated with Claude Code