You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@druid.apache.org by "FrankChen021 (via GitHub)" <gi...@apache.org> on 2026/07/30 15:12:43 UTC
[PR] Fix web console dependency vulnerabilities (druid)
FrankChen021 opened a new pull request, #19815:
URL: https://github.com/apache/druid/pull/19815
## Summary
- upgrades the direct runtime dependencies ECharts to 6.1.0 and UUID to 11.1.1
- upgrades PostCSS and webpack to patched releases and pins patched transitive versions for Babel, `@tootallnate/once`, `brace-expansion`, `fast-uri`, `flatted`, `js-yaml`, `minimatch`, `picomatch`, and `yaml`
- adds patched AJV 8 at the root so webpack's schema tooling resolves its expected major while AJV 6 consumers remain nested
- updates the webpack `global` shim to `globalThis.global`, preserving React Ace's assign/delete SSR behavior under the newer webpack optimizer
- regenerates the web-console third-party license inventory
## Dependabot coverage
This lockfile removes vulnerable versions for all 28 currently open alerts associated with `web-console/package-lock.json`:
- #743, #742, #733, #732, #713, #712, #704, #702
- #692, #690, #689, #666, #638, #636, #622, #618
- #601, #548, #546, #541, #538, #516, #513, #511
- #486, #485, #459, #457
Every occurrence of each affected package in the resulting lockfile was checked against the alert's vulnerable version range; all 28 checks are clear.
## Compatibility impact
ECharts moves from major 5 to major 6 and UUID moves from major 7 to major 11. Existing console imports and type usage compile without source changes, and the complete unit suite passes. The webpack shim adjustment is required for a minified production build with webpack 5.104+.
## Validation
- `npm ci`
- `npm run test-unit` — 158 suites, 785 tests, and 247 snapshots passed
- `npm run compile -- --force`
- `npm run check-licenses`
- `git diff --check`
- programmatic verification of all 28 GitHub alert ranges against every matching lockfile occurrence
## Caveat
A newer npm advisory for `brace-expansion` now marks all releases through 5.0.7 vulnerable. Fixing that separate advisory would require forcing legacy consumers across multiple major versions to 5.0.8+, which is outside the 28-alert GitHub batch and is not done here without upstream compatibility work.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3990224715
##########
web-console/package.json:
##########
@@ -155,12 +156,27 @@
"ts-loader": "^9.5.1",
"ts-node": "^10.9.2",
"typescript": "~5.5.4",
- "webpack": "^5.89.0",
+ "webpack": "^5.104.1",
"webpack-bundle-analyzer": "^4.10.1",
"webpack-cli": "^5.1.4",
"webpack-dev-server": "^5.2.6"
},
"overrides": {
- "@types/react": "$@types/react"
+ "@babel/core": "7.29.6",
+ "@tootallnate/once": "2.0.1",
+ "@types/react": "$@types/react",
+ "brace-expansion@<2": "1.1.18",
+ "brace-expansion@>=2": "2.1.4",
Review Comment:
[P2] Scope brace-expansion override by major
This blanket override now catches the `^5.0.2` dependency declared by the current `@typescript-eslint/typescript-estree` subtree's `minimatch@9.0.7`, but the generated lock installs `brace-expansion@2.1.4` instead. That unsupported major downgrade can break or alter brace matching in the ESLint/typecheck toolchain. Scope the override to `<5` and handle `>=5` with a compatible release, or pin minimatch to a version that still declares the 2.x dependency.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3914097821
##########
web-console/webpack.config.mjs:
##########
@@ -56,9 +56,14 @@ export default env => {
console.log(`Webpack running in ${mode} mode.`);
const plugins = [
+ new webpack.BannerPlugin({
+ banner: 'globalThis.global ??= globalThis;',
Review Comment:
[P2] Raw banner uses unsupported nullish-assignment syntax
Because raw is true, ??= is emitted verbatim and bypasses transpilation. The browserslist only requires ES6 support, so an otherwise supported pre-ES2021 browser fails to parse the bundle before the global shim runs. Use syntax compatible with the declared targets or narrow the browser targets accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3720928891
##########
web-console/webpack.config.mjs:
##########
@@ -58,7 +58,7 @@ export default env => {
const plugins = [
new webpack.DefinePlugin({
'process.env': JSON.stringify({ NODE_ENV: mode }),
- 'global': {},
+ 'global': 'globalThis',
Review Comment:
Addressed in 6483f343a2. A raw entry banner initializes `globalThis.global` before modules execute, and DefinePlugin now maps `global` to the assignable `globalThis.global` property. This preserves both property access and assignment semantics. `npm run compile` passed, the built entry begins with the shim, and `npm run test-unit` passed all 158 suites / 785 tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3728799124
##########
web-console/webpack.config.mjs:
##########
@@ -56,9 +56,14 @@ export default env => {
console.log(`Webpack running in ${mode} mode.`);
const plugins = [
+ new webpack.BannerPlugin({
+ banner: 'globalThis.global ??= globalThis;',
Review Comment:
[P2] Keep the raw banner within supported syntax
`BannerPlugin` uses `raw: true`, so this `??=` expression is prepended verbatim and is never lowered by TypeScript or webpack. Resolving the checked-in Browserslist configuration against this lockfile includes KaiOS 2.5, whose Firefox 48-era engine cannot parse nullish assignment; it will reject the entire entry bundle before the console renders. Use an ES2016-compatible conditional assignment or route the shim through transpilation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3720848918
##########
web-console/webpack.config.mjs:
##########
@@ -58,7 +58,7 @@ export default env => {
const plugins = [
new webpack.DefinePlugin({
'process.env': JSON.stringify({ NODE_ENV: mode }),
- 'global': {},
+ 'global': 'globalThis',
Review Comment:
Defining `global` as `globalThis` via `DefinePlugin` can break dependencies that assign to `global` (e.g., `global = ...` becomes `globalThis = ...`, which is an invalid assignment in strict mode). If the intent is to preserve assign/delete behavior, define it as a property (e.g., `globalThis.global`) and ensure the shim matches that behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "FrankChen021 (via GitHub)" <gi...@apache.org>.
FrankChen021 commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3686788475
##########
web-console/webpack.config.mjs:
##########
@@ -58,7 +58,7 @@ export default env => {
const plugins = [
new webpack.DefinePlugin({
'process.env': JSON.stringify({ NODE_ENV: mode }),
- 'global': {},
+ 'global': 'globalThis.global',
'NODE_ENV': JSON.stringify(mode),
Review Comment:
Addressed in bc19ec8748. DefinePlugin now maps global directly to globalThis; the production web-console compile completed successfully.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #19815:
URL: https://github.com/apache/druid/pull/19815#discussion_r3686695997
##########
web-console/webpack.config.mjs:
##########
@@ -58,7 +58,7 @@ export default env => {
const plugins = [
new webpack.DefinePlugin({
'process.env': JSON.stringify({ NODE_ENV: mode }),
- 'global': {},
+ 'global': 'globalThis.global',
'NODE_ENV': JSON.stringify(mode),
Review Comment:
`DefinePlugin` sets `global` to `globalThis.global`, but in browsers `globalThis.global` is typically `undefined`. Any bundled code that does property access like `global.Buffer` / `global.process` / `global.ace` would become `globalThis.global.<prop>` and can throw at runtime. Defining `global` as `globalThis` avoids the extra indirection and ensures it always points at the real global object in both browser and Node/Jest.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org
Re: [PR] fix: address web console dependency vulnerabilities (druid)
Posted by "vogievetsky (via GitHub)" <gi...@apache.org>.
vogievetsky merged PR #19815:
URL: https://github.com/apache/druid/pull/19815
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org