You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Purushottam Sinha (Jira)" <ji...@apache.org> on 2026/04/22 18:18:00 UTC
[jira] [Comment Edited] (FLINK-39516) [web dashboard] Address npm security advisories in flink-runtime-web web-dashboard

    [ https://issues.apache.org/jira/browse/FLINK-39516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18075528#comment-18075528 ] 

Purushottam Sinha edited comment on FLINK-39516 at 4/22/26 6:17 PM:
--------------------------------------------------------------------

Summary
|Severity|Before|After|Resolved|
|----------|------:|------:|---------:|
|Critical|    2|    2|       0|
|High    |   30|   16|      14|
|Moderate|   17|   10|       7|
|Low      |    6|    3|       3|
|*{*}Total{*}*|   *{*}55{*}*|   *{*}31{*}*|  *{*}24{*}*|

The remaining 31 findings require semver-major upgrades (`npm audit fix --force`) and are not addressed here.

Resolved Findings
|Severity|Package|Before → After|Advisories|
|----------|---------|----------------|------------|
|high|`@angular/cli`|`20.1.3` → `20.3.24`|*transitive only*|
|high|`@isaacs/brace-expansion`|`5.0.0` → *removed*|[GHSA-7h2j-956f-4vf2]([https://github.com/advisories/GHSA-7h2j-956f-4vf2])|
|high|`@modelcontextprotocol/sdk`|`1.13.3` → `1.26.0`|[GHSA-8r9q-7v3j-jr4g]([https://github.com/advisories/GHSA-8r9q-7v3j-jr4g])<br>[GHSA-345p-7cg4-v4c7]([https://github.com/advisories/GHSA-345p-7cg4-v4c7])<br>[GHSA-w48q-cv73-mx4w]([https://github.com/advisories/GHSA-w48q-cv73-mx4w])|
|high|`express`|`4.21.2, 5.1.0` → `4.22.1, 5.2.1`|*transitive only*|
|high|`flatted`|`3.3.2` → `3.4.2`|[GHSA-25h7-pfq9-p65f]([https://github.com/advisories/GHSA-25h7-pfq9-p65f])<br>[GHSA-rf6f-7fwh-wjgh]([https://github.com/advisories/GHSA-rf6f-7fwh-wjgh])|
|high|`glob`|`10.4.5, 7.2.3` → `13.0.6, 7.2.3`|[GHSA-5j98-mcp5-4vw2]([https://github.com/advisories/GHSA-5j98-mcp5-4vw2])|
|high|`immutable`|`5.1.3` → `5.1.5`|[GHSA-wf6x-7x77-mvgw]([https://github.com/advisories/GHSA-wf6x-7x77-mvgw])|
|high|`lodash`|`4.17.21` → `4.18.1`|[GHSA-xxjr-mmjv-4gpg]([https://github.com/advisories/GHSA-xxjr-mmjv-4gpg])<br>[GHSA-r5fr-rjxr-66jc]([https://github.com/advisories/GHSA-r5fr-rjxr-66jc])<br>[GHSA-f23m-r3pf-42rh]([https://github.com/advisories/GHSA-f23m-r3pf-42rh])|
|high|`minimatch`|`10.0.3, 3.1.2, 9.0.5` → `10.2.5, 3.1.5, 9.0.9`|[GHSA-3ppc-4f35-3m26]([https://github.com/advisories/GHSA-3ppc-4f35-3m26])<br>[GHSA-7r86-cg39-jmmj]([https://github.com/advisories/GHSA-7r86-cg39-jmmj])<br>[GHSA-23c5-xmqv-rm74]([https://github.com/advisories/GHSA-23c5-xmqv-rm74])|
|high|`node-forge`|`1.3.1` → `1.4.0`|[GHSA-554w-wpv2-vw27]([https://github.com/advisories/GHSA-554w-wpv2-vw27])<br>[GHSA-5gfm-wpxj-wjgq]([https://github.com/advisories/GHSA-5gfm-wpxj-wjgq])<br>[GHSA-65ch-62r8-g69g]([https://github.com/advisories/GHSA-65ch-62r8-g69g])<br>[GHSA-2328-f5f3-gj25]([https://github.com/advisories/GHSA-2328-f5f3-gj25])<br>[GHSA-q67f-28xg-22rw]([https://github.com/advisories/GHSA-q67f-28xg-22rw])<br>[GHSA-5m6q-g25r-mvwx]([https://github.com/advisories/GHSA-5m6q-g25r-mvwx])<br>[GHSA-ppp5-5v6c-4jwp]([https://github.com/advisories/GHSA-ppp5-5v6c-4jwp])|
|high|`pacote`|`21.0.0` → `21.0.4`|*transitive only*|
|high|`path-to-regexp`|`0.1.12, 8.2.0` → `0.1.13, 8.4.2`|[GHSA-37ch-88jc-xwx2]([https://github.com/advisories/GHSA-37ch-88jc-xwx2])<br>[GHSA-j3q9-mxjg-w52f]([https://github.com/advisories/GHSA-j3q9-mxjg-w52f])<br>[GHSA-27v5-c462-wpq7]([https://github.com/advisories/GHSA-27v5-c462-wpq7])|
|high|`tar`|`6.2.1, 7.4.3` → `7.5.13`|[GHSA-34x7-hfp2-rc4v]([https://github.com/advisories/GHSA-34x7-hfp2-rc4v])<br>[GHSA-8qq5-rm4j-mr97]([https://github.com/advisories/GHSA-8qq5-rm4j-mr97])<br>[GHSA-83g3-92jg-28cx]([https://github.com/advisories/GHSA-83g3-92jg-28cx])<br>[GHSA-qffp-2rhf-9h96]([https://github.com/advisories/GHSA-qffp-2rhf-9h96])<br>[GHSA-9ppj-qmqm-q256]([https://github.com/advisories/GHSA-9ppj-qmqm-q256])<br>[GHSA-r6q2-hw4h-h46w]([https://github.com/advisories/GHSA-r6q2-hw4h-h46w])|
|high|`terser-webpack-plugin`|`5.3.14` → `5.4.0`|*transitive only*|
|moderate|`@angular-devkit/schematics`|`20.1.3` → `20.3.24`|*transitive only*|
|moderate|`@schematics/angular`|`20.1.3` → `20.3.24`|*transitive only*|
|moderate|`body-parser`|`1.20.3, 2.2.0` → `1.20.4, 2.2.2`|[GHSA-wqch-xfxh-vrr4]([https://github.com/advisories/GHSA-wqch-xfxh-vrr4])|
|moderate|`brace-expansion`|`1.1.11, 2.0.2` → `1.1.14, 2.1.0, 5.0.5`|[GHSA-v6h2-p8h4-qcjw]([https://github.com/advisories/GHSA-v6h2-p8h4-qcjw])<br>[GHSA-f886-m6hf-6m8v]([https://github.com/advisories/GHSA-f886-m6hf-6m8v])|
|moderate|`follow-redirects`|`1.15.9` → `1.16.0`|[GHSA-r4q5-vmmm-2653]([https://github.com/advisories/GHSA-r4q5-vmmm-2653])|
|moderate|`js-yaml`|`4.1.0` → `4.1.1`|[GHSA-mh29-5h37-fv8m]([https://github.com/advisories/GHSA-mh29-5h37-fv8m])|
|moderate|`yaml`|`1.10.2, 2.8.0` → `1.10.3, 2.8.3`|[GHSA-48c2-rrv3-qjmp]([https://github.com/advisories/GHSA-48c2-rrv3-qjmp])|
|low|`@inquirer/editor`|`4.2.15` → `4.2.23`|*transitive only*|
|low|`diff`|`4.0.2` → `4.0.4`|[GHSA-73rr-hh4g-fpgx]([https://github.com/advisories/GHSA-73rr-hh4g-fpgx])|
|low|`external-editor`|`3.1.0` → *removed*|*transitive only*|


was (Author: JIRAUSER310845):
## Summary

| Severity | Before | After | Resolved |
|----------|------:|------:|---------:|
| Critical |     2 |     2 |        0 |
| High     |    30 |    16 |       14 |
| Moderate |    17 |    10 |        7 |
| Low      |     6 |     3 |        3 |
| **Total** |    **55** |    **31** |   **24** |

The remaining 31 findings require semver-major upgrades (`npm audit fix --force`) and are not addressed here.

## Resolved Findings

| Severity | Package | Before → After | Advisories |
|----------|---------|----------------|------------|
| high | `@angular/cli` | `20.1.3` → `20.3.24` | *transitive only* |
| high | `@isaacs/brace-expansion` | `5.0.0` → *removed* | [GHSA-7h2j-956f-4vf2](https://github.com/advisories/GHSA-7h2j-956f-4vf2) |
| high | `@modelcontextprotocol/sdk` | `1.13.3` → `1.26.0` | [GHSA-8r9q-7v3j-jr4g](https://github.com/advisories/GHSA-8r9q-7v3j-jr4g)<br>[GHSA-345p-7cg4-v4c7](https://github.com/advisories/GHSA-345p-7cg4-v4c7)<br>[GHSA-w48q-cv73-mx4w](https://github.com/advisories/GHSA-w48q-cv73-mx4w) |
| high | `express` | `4.21.2, 5.1.0` → `4.22.1, 5.2.1` | *transitive only* |
| high | `flatted` | `3.3.2` → `3.4.2` | [GHSA-25h7-pfq9-p65f](https://github.com/advisories/GHSA-25h7-pfq9-p65f)<br>[GHSA-rf6f-7fwh-wjgh](https://github.com/advisories/GHSA-rf6f-7fwh-wjgh) |
| high | `glob` | `10.4.5, 7.2.3` → `13.0.6, 7.2.3` | [GHSA-5j98-mcp5-4vw2](https://github.com/advisories/GHSA-5j98-mcp5-4vw2) |
| high | `immutable` | `5.1.3` → `5.1.5` | [GHSA-wf6x-7x77-mvgw](https://github.com/advisories/GHSA-wf6x-7x77-mvgw) |
| high | `lodash` | `4.17.21` → `4.18.1` | [GHSA-xxjr-mmjv-4gpg](https://github.com/advisories/GHSA-xxjr-mmjv-4gpg)<br>[GHSA-r5fr-rjxr-66jc](https://github.com/advisories/GHSA-r5fr-rjxr-66jc)<br>[GHSA-f23m-r3pf-42rh](https://github.com/advisories/GHSA-f23m-r3pf-42rh) |
| high | `minimatch` | `10.0.3, 3.1.2, 9.0.5` → `10.2.5, 3.1.5, 9.0.9` | [GHSA-3ppc-4f35-3m26](https://github.com/advisories/GHSA-3ppc-4f35-3m26)<br>[GHSA-7r86-cg39-jmmj](https://github.com/advisories/GHSA-7r86-cg39-jmmj)<br>[GHSA-23c5-xmqv-rm74](https://github.com/advisories/GHSA-23c5-xmqv-rm74) |
| high | `node-forge` | `1.3.1` → `1.4.0` | [GHSA-554w-wpv2-vw27](https://github.com/advisories/GHSA-554w-wpv2-vw27)<br>[GHSA-5gfm-wpxj-wjgq](https://github.com/advisories/GHSA-5gfm-wpxj-wjgq)<br>[GHSA-65ch-62r8-g69g](https://github.com/advisories/GHSA-65ch-62r8-g69g)<br>[GHSA-2328-f5f3-gj25](https://github.com/advisories/GHSA-2328-f5f3-gj25)<br>[GHSA-q67f-28xg-22rw](https://github.com/advisories/GHSA-q67f-28xg-22rw)<br>[GHSA-5m6q-g25r-mvwx](https://github.com/advisories/GHSA-5m6q-g25r-mvwx)<br>[GHSA-ppp5-5v6c-4jwp](https://github.com/advisories/GHSA-ppp5-5v6c-4jwp) |
| high | `pacote` | `21.0.0` → `21.0.4` | *transitive only* |
| high | `path-to-regexp` | `0.1.12, 8.2.0` → `0.1.13, 8.4.2` | [GHSA-37ch-88jc-xwx2](https://github.com/advisories/GHSA-37ch-88jc-xwx2)<br>[GHSA-j3q9-mxjg-w52f](https://github.com/advisories/GHSA-j3q9-mxjg-w52f)<br>[GHSA-27v5-c462-wpq7](https://github.com/advisories/GHSA-27v5-c462-wpq7) |
| high | `tar` | `6.2.1, 7.4.3` → `7.5.13` | [GHSA-34x7-hfp2-rc4v](https://github.com/advisories/GHSA-34x7-hfp2-rc4v)<br>[GHSA-8qq5-rm4j-mr97](https://github.com/advisories/GHSA-8qq5-rm4j-mr97)<br>[GHSA-83g3-92jg-28cx](https://github.com/advisories/GHSA-83g3-92jg-28cx)<br>[GHSA-qffp-2rhf-9h96](https://github.com/advisories/GHSA-qffp-2rhf-9h96)<br>[GHSA-9ppj-qmqm-q256](https://github.com/advisories/GHSA-9ppj-qmqm-q256)<br>[GHSA-r6q2-hw4h-h46w](https://github.com/advisories/GHSA-r6q2-hw4h-h46w) |
| high | `terser-webpack-plugin` | `5.3.14` → `5.4.0` | *transitive only* |
| moderate | `@angular-devkit/schematics` | `20.1.3` → `20.3.24` | *transitive only* |
| moderate | `@schematics/angular` | `20.1.3` → `20.3.24` | *transitive only* |
| moderate | `body-parser` | `1.20.3, 2.2.0` → `1.20.4, 2.2.2` | [GHSA-wqch-xfxh-vrr4](https://github.com/advisories/GHSA-wqch-xfxh-vrr4) |
| moderate | `brace-expansion` | `1.1.11, 2.0.2` → `1.1.14, 2.1.0, 5.0.5` | [GHSA-v6h2-p8h4-qcjw](https://github.com/advisories/GHSA-v6h2-p8h4-qcjw)<br>[GHSA-f886-m6hf-6m8v](https://github.com/advisories/GHSA-f886-m6hf-6m8v) |
| moderate | `follow-redirects` | `1.15.9` → `1.16.0` | [GHSA-r4q5-vmmm-2653](https://github.com/advisories/GHSA-r4q5-vmmm-2653) |
| moderate | `js-yaml` | `4.1.0` → `4.1.1` | [GHSA-mh29-5h37-fv8m](https://github.com/advisories/GHSA-mh29-5h37-fv8m) |
| moderate | `yaml` | `1.10.2, 2.8.0` → `1.10.3, 2.8.3` | [GHSA-48c2-rrv3-qjmp](https://github.com/advisories/GHSA-48c2-rrv3-qjmp) |
| low | `@inquirer/editor` | `4.2.15` → `4.2.23` | *transitive only* |
| low | `diff` | `4.0.2` → `4.0.4` | [GHSA-73rr-hh4g-fpgx](https://github.com/advisories/GHSA-73rr-hh4g-fpgx) |
| low | `external-editor` | `3.1.0` → *removed* | *transitive only* |

>  [web dashboard] Address npm security advisories in flink-runtime-web web-dashboard
> -----------------------------------------------------------------------------------
>
>                 Key: FLINK-39516
>                 URL: https://issues.apache.org/jira/browse/FLINK-39516
>             Project: Flink
>          Issue Type: Technical Debt
>          Components: Runtime / Web Frontend
>            Reporter: Purushottam Sinha
>            Priority: Minor
>              Labels: pull-request-available
>
>  {*}Description{*}:
> `npm audit` against flink-runtime-web/web-dashboard currently reports 55 advisories (2 critical, 30 high, 17 moderate, 6 low). None are in runtime-shipped code — the dashboard is a static Angular SPA served by the JobManager — but the critical and high findings appear in GHAS/Dependabot scans and block clean audit reports for downstream consumers.                                                                      
> *Goal:* Drive the advisory count to zero (or to an explicitly documented residual set) without regressing the dashboard build or runtime behavior.
> Approach is split into two phases because the fixes fall into two distinct categories:
> 1. SemVer-compatible fixes (lockfile-only): transitives with patches inside the currently declared SemVer ranges. Low risk, no package.json churn
> 2. Major-version upgrades (package.json changes): advisories whose patches only exist in a new major. Higher risk — touches the Angular framework, the Angular build tooling, and the deprecated Protractor subtree pulled in by @angular-devkit/build-angular.   



--
This message was sent by Atlassian Jira
(v8.20.10#820010)