[GitHub] [superset] villebro commented on issue #18879: Superset includes a number of vulnerable 3rd party JS packages

[GitBox <gi...@apache.org>]

villebro commented on issue #18879:
URL: https://github.com/apache/superset/issues/18879#issuecomment-1049753871


   I opened a PR to bring the `urijs` and `xss` packages up to date: #18922 . `ajv` appears to be used in `storybook` and build tools so shouldn't affect runtime, and `trim` should not affect Superset, as it's a ReDoS and we're currently only running JS on the frontend.
   
   Feel free to hack away at the remaining ones if you have the time. One dep that would probably solve a lot of `npm audit` complaints is `react-markdown`. Updating that to the latest version (8.0.0, but even 7.1.2 would be nice if there's concern that a x.0.0 may be unstable) will require some refactoring, but would be very valuable work.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org