You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/05/30 03:47:31 UTC
[PR] chore(deps): force lodash 4.18.1 in docs to fix code-injection CVE [superset]
rusackas opened a new pull request, #40535:
URL: https://github.com/apache/superset/pull/40535
### SUMMARY
Resolves high-severity Dependabot alert [#1154](https://github.com/apache/superset/security/dependabot/1154) — `lodash` code injection via `_.template` import key names (GHSA-r5fr-rjxr-66jc), vulnerable `<= 4.17.23`, patched in `4.18.0`.
**Why Dependabot couldn't fix it:** the alert is for a transitive dependency in `docs/yarn.lock`. Three Postman packages pulled in via the OpenAPI docs plugin hard-pin lodash to an exact `4.17.21` (no caret):
- `openapi-to-postmanv2`
- `postman-code-generators`
- `postman-collection`
Because the pin is exact, the vulnerable `4.17.21` stayed in the lockfile alongside the already-patched `4.18.1` resolved elsewhere — Dependabot can't bump it without an upstream release from those packages.
**Fix:** add a yarn `resolutions` override forcing every lodash request to `4.18.1` — a backward-compatible bump within the 4.x line that contains the `_.template` fix. `yarn install` collapses the two lockfile entries into one and removes `lodash-4.17.21.tgz` entirely.
### BEFORE/AFTER
`docs/yarn.lock` previously had two lodash entries (`4.17.21` and `4.18.1`); after this change there is a single entry resolving to `4.18.1`.
### TESTING INSTRUCTIONS
- [ ] CI passes
- [ ] `yarn install` in `docs/` resolves lodash to `4.18.1` with no `4.17.21` remaining (`grep lodash-4.17.21 docs/yarn.lock` returns nothing)
- [ ] Docs build succeeds (no runtime/behavior change — patch-level lodash bump)
### ADDITIONAL INFORMATION
- [ ] Has associated issue: Dependabot alert #1154
- [ ] Required feature flags: n/a
- [ ] Changes UI: No
- [ ] Includes DB Migration: No
- [ ] Introduces new feature or API: No
- [ ] Removes existing feature or API: No
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): force lodash 4.18.1 in docs to fix code-injection CVE [superset]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #40535:
URL: https://github.com/apache/superset/pull/40535#issuecomment-4581556055
Congrats on making your first PR and thank you for contributing to Superset! :tada: :heart:
Please read our [New Contributor Welcome & Expectations](https://github.com/apache/superset/wiki/New-Contributor-Welcome-&-Expectations) guide.
We hope to see you in our [Slack](https://apache-superset.slack.com/) community too! Not signed up? Use our [Slack App](http://bit.ly/join-superset-slack) to self-register.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): pin lodash, lodash-es, and yaml in docs to patched releases [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40535:
URL: https://github.com/apache/superset/pull/40535#issuecomment-4582062543
**Bito Automatic Review Skipped – PR Already Merged**<br/><br/>Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.<br/>No action is needed if you didn't intend to review it. To get a review, you can type `/review` in a comment and save it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): force lodash 4.18.1 in docs to fix code-injection CVE [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40535:
URL: https://github.com/apache/superset/pull/40535#issuecomment-4581563166
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 454fab6b2fdd4833281af165181f6f338a70c7cb |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a1a5dd460f76b00089630cd |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-40535--superset-docs-preview.netlify.app](https://deploy-preview-40535--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcrLDYAgDADQXXqWWKPiZwPHgBbDASwBNTHG3eX2Du-FlCWmE1aABmw2B_lq8pJda6-YVBA2xSsWKopuVxe7FOTZuD5tOjMyDxr3SVtEnBfdIzF8Pw) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-40535--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): force lodash 4.18.1 in docs to fix code-injection CVE [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40535:
URL: https://github.com/apache/superset/pull/40535#issuecomment-4581555379
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] chore(deps): pin lodash, lodash-es, and yaml in docs to patched releases [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #40535:
URL: https://github.com/apache/superset/pull/40535
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org