[PR] [HOTFIX] Dedupe minimatch and bump postcss in zeppelin-react [zeppelin]

["voidmatcha (via GitHub)" <gi...@apache.org>]

voidmatcha opened a new pull request, #5352:
URL: https://github.com/apache/zeppelin/pull/5352

   ### What is this PR for?
   
   The `npm-audit` job fails on master with seven high findings, all in `devDependencies`:
   
   - `brace-expansion <=5.0.7`, GHSA-mh99-v99m-4gvg (DoS via unbounded expansion)
   - `postcss <=8.5.17`, GHSA-r28c-9q8g-f849 (path traversal in source map auto-loading)
   
   `minimatch@10.2.5` is already hoisted at the top of `zeppelin-react`'s tree. The vulnerable `brace-expansion@1.1.16` comes from four *nested* copies of `minimatch@3.1.5`, under `eslint`, `@eslint/eslintrc`, `@eslint/config-array` and `eslint-plugin-react`. An `overrides` entry for `minimatch` collapses those onto the version already present, removing `minimatch@3` from the tree, and `brace-expansion` then moves 5.0.7 to 5.0.8.
   
   `postcss` moves 8.5.15 to 8.5.23 in the lockfile (`npm audit fix`, no `package.json` change; `nanoid` follows as its dependency). That is the same bump as #5341, which this supersedes.
   
   The result is `found 0 vulnerabilities`. The gate itself is unchanged: still `--audit-level=high` over the full dependency tree, so `devDependencies` keep their CI coverage.
   
   Upgrading the eslint side is not an alternative here. `eslint-plugin-react@7.37.5` is the latest release, declares `minimatch@^3.1.2` itself, and does not run on eslint 10 (`TypeError: contextOrFilename.getFilename is not a function` at `lib/util/version.js:31`), so no version bump removes the nested copy. Overriding `brace-expansion` alone does not work either, because 5.0.8 drops the CJS default export that `minimatch@3.1.5` calls, which gives a green audit and `TypeError: expand is not a function` on lint. Overriding both avoids that, since `minimatch@10` does not use the removed export.
   
   The lockfile shrinks by 129 lines, dropping the four nested `minimatch` / `brace-expansion` / `balanced-match` trees and `concat-map`.
   
   ### What type of PR is it?
   Hot Fix
   
   ### Todos
   
   ### What is the Jira issue?
   
   ### How should this be tested?
   
   The `npm-audit` job on this PR. Locally, from a deleted `node_modules` in `zeppelin-web-angular/projects/zeppelin-react`:
   
   ```
   $ npm ci --ignore-scripts && npm audit --audit-level=high
   found 0 vulnerabilities      # exit 0 (master: 7 high, exit 1)
   $ npm run lint               # exit 0
   $ npm run build              # exit 0
   $ npm test                   # 14 passed
   ```
   
   ### Screenshots (if appropriate)
   
   ### Questions:
   * Does the license files need to update? No
   * Is there breaking changes for older versions? No
   * Does this needs documentation? No
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [HOTFIX] Dedupe minimatch and bump postcss in zeppelin-react [zeppelin]

["tbonelee (via GitHub)" <gi...@apache.org>]

tbonelee commented on PR #5352:
URL: https://github.com/apache/zeppelin/pull/5352#issuecomment-5092505586

   Merged into master


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [HOTFIX] Dedupe minimatch and bump postcss in zeppelin-react [zeppelin]

["tbonelee (via GitHub)" <gi...@apache.org>]

tbonelee merged PR #5352:
URL: https://github.com/apache/zeppelin/pull/5352


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: reviews-unsubscribe@zeppelin.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org