You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@spark.apache.org by "LuciferYang (via GitHub)" <gi...@apache.org> on 2026/03/26 09:39:14 UTC

[PR] [SPARK-56236][TESTS] Fix npm vulnerabilities related to picomatch [spark]

LuciferYang opened a new pull request, #55032:
URL: https://github.com/apache/spark/pull/55032

   ### What changes were proposed in this pull request?
   This pr aims to fix npm vulnerabilities related to picomatch in `ui-test`:
   
   ```
   npm audit report
   # npm audit report
   
   picomatch  <=2.3.1 || 4.0.0 - 4.0.3
   Severity: high
   Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
   Picomatch has a ReDoS vulnerability via extglob quantifiers - https://github.com/advisories/GHSA-c2c7-rcm5-vvqj
   Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
   Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching - https://github.com/advisories/GHSA-3v7f-55p6-f55p
   fix available via `npm audit fix`
   node_modules/jest-util/node_modules/picomatch
   node_modules/picomatch
   
   1 high severity vulnerability
   
   To address all issues, run:
     npm audit fix
   
   ```
   
   ### Why are the changes needed?
   To fix https://github.com/apache/spark/security/dependabot/178 and https://github.com/apache/spark/security/dependabot/176
   
   
   ### Does this PR introduce _any_ user-facing change?
   No
   
   
   ### How was this patch tested?
   Pass Github Actions
   
   ### Was this patch authored or co-authored using generative AI tooling?
   No
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

Re: [PR] [SPARK-56236][TESTS] Fix npm vulnerabilities related to `picomatch` [spark]

Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang commented on PR #55032:
URL: https://github.com/apache/spark/pull/55032#issuecomment-4135530796

   Merged into master. Thanks @yaooqinn 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org

Re: [PR] [SPARK-56236][TESTS] Fix npm vulnerabilities related to `picomatch` [spark]

Posted by "LuciferYang (via GitHub)" <gi...@apache.org>.
LuciferYang closed pull request #55032: [SPARK-56236][TESTS] Fix npm vulnerabilities related to `picomatch`
URL: https://github.com/apache/spark/pull/55032


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: reviews-unsubscribe@spark.apache.org
For additional commands, e-mail: reviews-help@spark.apache.org