[jira] [Created] (ATLAS-5348) Atlas React UI: Upgrading frontend transitive dependencies

["Brijesh Bhalala (Jira)" <ji...@apache.org>]

Brijesh Bhalala created ATLAS-5348:
--------------------------------------

             Summary: Atlas React UI: Upgrading frontend transitive dependencies
                 Key: ATLAS-5348
                 URL: https://issues.apache.org/jira/browse/ATLAS-5348
             Project: Atlas
          Issue Type: Task
          Components:  atlas-core
    Affects Versions: 2.5.0
            Reporter: Brijesh Bhalala
            Assignee: Brijesh Bhalala


Currently, running `npm audit` on the Atlas React UI (`/dashboard`) flags 8 outdated transitive dependencies that need to be upgraded to their patched versions. 

This issue tracks running `npm audit fix` to automatically bump these frontend packages in the `package-lock.json` and resolve the following warnings:

- **@babel/core (<=7.29.0):** Arbitrary File Read via sourceMappingURL Comment
- **@tootallnate/once (<2.0.1):** Incorrect Control Flow Scoping
- **form-data (4.0.0 - 4.0.5):** CRLF injection in form-data via unescaped multipart field names (High Severity)
- **picomatch (<=2.3.1):** Method Injection in POSIX Character Classes and ReDoS vulnerability (High Severity)
- **postcss (<8.5.10):** XSS via Unescaped `</style>` in CSS Stringify Output (Moderate Severity)
- **quill (=2.0.3):** XSS via HTML export feature
- **ws (8.0.0 - 8.20.1):** Uninitialized memory disclosure & Memory exhaustion DoS (High Severity)
- **yaml (1.0.0 - 1.10.2):** Stack Overflow via deeply nested YAML collections (Moderate Severity)

**Total:** 8 warnings (3 low, 2 moderate, 3 high)

**Resolution:**
Ran `npm audit fix` in the `dashboard` directory to update the `package-lock.json` and safely bump all affected transitive dependencies.




--
This message was sent by Atlassian Jira
(v8.20.10#820010)