Skip to content

ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies#703

Open
Brijesh619 wants to merge 1 commit into
apache:masterfrom
Brijesh619:ATLAS-5348
Open

ATLAS-5348: Atlas React UI: Upgrading frontend transitive dependencies#703
Brijesh619 wants to merge 1 commit into
apache:masterfrom
Brijesh619:ATLAS-5348

Conversation

@Brijesh619

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

This PR resolves ATLAS-5348 by upgrading several outdated frontend transitive dependencies in the Atlas React UI (/dashboard).

Currently, running npm audit on the React UI flags 8 outdated transitive dependencies. This patch safely updates the package-lock.json (via npm audit fix) to bump these packages and resolve the following warnings:

  • @babel/core (<=7.29.0): Arbitrary File Read via sourceMappingURL Comment
  • @tootallnate/once (<2.0.1): Incorrect Control Flow Scoping
  • form-data (4.0.0 - 4.0.5): CRLF injection in form-data via unescaped multipart field names (High Severity)
  • picomatch (<=2.3.1): Method Injection in POSIX Character Classes and ReDoS vulnerability (High Severity)
  • postcss (<8.5.10): XSS via Unescaped </style> in CSS Stringify Output (Moderate Severity)
  • quill (=2.0.3): XSS via HTML export feature
  • ws (8.0.0 - 8.20.1): Uninitialized memory disclosure & Memory exhaustion DoS (High Severity)
  • yaml (1.0.0 - 1.10.2): Stack Overflow via deeply nested YAML collections (Moderate Severity)

How was this patch tested?

  • Manual Verification: Ran npm audit locally in the /dashboard directory to verify that all 8 security warnings have been successfully cleared.
  • Build Test: Ran npm run build to ensure the React UI bundles successfully without any regressions from the bumped transitive dependencies.
  • Runtime Test: Started the local dev server and verified the UI loads and functions as expected.

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-07-22 10-51-37

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-07-23 11-20-05

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-07-23 11-20-32

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant