This repository has been archived by the owner on Jul 16, 2024. It is now read-only.

[Snyk] Fix for 2 vulnerabilities #278

Open

m-ajay wants to merge 1 commit into master from snyk-fix-3fd4dd4fd27a23870af0786706b4868a

Owner

m-ajay commented Mar 22, 2024

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- superset-frontend/temporary_superset_ui/superset-ui/package.json
- superset-frontend/temporary_superset_ui/superset-ui/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	718/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.5	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	Yes	Proof of Concept
	763/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.4	Path Traversal SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: lerna

The new version differs by 250 commits.

02c534e chore: remove unnecessary write-json-file dep (Explore update button labels apache/superset#3534)
fa1f490 feat(publish): add --include-private option for testing private packages (Feature: Dashboard filters: datepicker and time granularity apache/superset#3503)
afde32e chore(deps): bump @ sideway/formula from 3.0.0 to 3.0.1 in /website (Break word on InfoTooltip apache/superset#3532)
f444045 chore(deps): bump @ sideway/formula from 3.0.0 to 3.0.1 ([style] no bold on dashboard widget headers apache/superset#3531)
ad39fe2 fix(create): normalize quotes and indents in generated test and lib files ([explore] using verbose_name in 'Time Column' control apache/superset#3529)
6b50725 chore: remove non-runtime deps from lerna package.json (try to fix problem that chrome window not opening after ajax requrest apache/superset#3528)
f03ee3e feat(publish): recover from network failure (Feature: query string API endpoint apache/superset#3513)
724633c chore(deps): bump http-cache-semantics from 4.1.0 to 4.1.1 (Show Verbose name in Time Column apache/superset#3525)
937b02a feat(run): allow multiple script targets to be triggered at once (Druid refresh metadata performance improvements apache/superset#3527)
aea79df chore(docs): add lerna watch -- build --include-dependents example (Feature: Making data gaps visible in line charts by inserting zeros apache/superset#3512)
1fe6188 chore(deps): bump http-cache-semantics from 4.1.0 to 4.1.1 in /website (Cannot created temp table in redshift DB apache/superset#3524)
aaccdfb chore(run): warn in docs about using yarn and passing args to lerna run (Time Series Annotation Layers apache/superset#3521)
b8dff21 chore: ci updates (Date Filter is not working on dashboard. apache/superset#3522)
70de43c chore: ci updates (npm run dev error apache/superset#3523)
116c62c chore: update docs (Druid metrics are not automatically detected in Superset apache/superset#3520)
86f8021 chore: apply typo fixes (Full Annotation Framework apache/superset#3518)
69a45de chore(deps): bump ua-parser-js from 0.7.32 to 0.7.33 in /website (Customizable and simplified interface for non-developers as a new dashboard apache/superset#3514)
fc094da chore: initial codebase refactor (sqlalchemy.exc.OperationalError apache/superset#3517)
510c3e9 fix(repair): re-enable repair generators (Fix idna requirement apache/superset#3497)
fcab26a chore(docs): update filter options docs to specify quote necessity (Added button on slice for export D3js graph to png apache/superset#3496)
a5217c6 chore(release): v6.4.1
24d0d5c fix(run): resolve erroneous failures (update contributing.md apache/superset#3495)
4688f9d chore(docs): remove state of js banner
eb4a755 chore(docs): add workspace watching feature doc ([Bugfix] nvd3 tooltips do not disappear apache/superset#3487)

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

c9271b9 chore(release): 4.0.0
18bf369 test: fix stability ([New Viz] Nightingale Rose Chart apache/superset#3676)
cdcabb2 fix: respect protocol from browser for manual setup (How can I change the visualization? Changes are not displayed in the browser. apache/superset#3675)
1768d6b fix: initial reloading for lazy compilation (Set logging level to debug for DummyStatsLogger apache/superset#3662)
4f5bab1 docs: improve examples (URL link to parent or blank does not work within Markup or Separator widget apache/superset#3672)
f2d87fb fix: improve https CLI output (Sorting slices alphabetically results in 500 - Internal Server Error apache/superset#3673)
0277c5e chore: remove redundant console statements (Adding new countries to Map view apache/superset#3671)
16fcdbc docs: add `ipc` example (Update 20171013 apache/superset#3667)
8915fb8 test: add e2e tests for built in routes ("Time Series Table" is missing hyphen apache/superset#3669)
4d1cbe1 docs: ask `version` information in issue template ([Explore] Altered Slice Tag apache/superset#3668)
b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (if superset will suport druid lookup or join apache/superset#3666)
ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (Add description for running specific test apache/superset#3665)
f1fdaa7 chore(release): 4.0.0-rc.1
c4678bc fix: legacy API ([stats_logger] entries flooding the console log apache/superset#3660)
d8bdd03 test: fix stability (Making the sort order for metrics pull from fd for time table viz apache/superset#3661)
22b1414 refactor: remove `killable` (Choose language is brocken apache/superset#3657)
75bafbf test: add e2e tests for module federation (failed to add oracle view as superset table. apache/superset#3658)
493ccbd chore(deps): update `ws` (Authentication: Enable user impersonation for Superset to HiveServer2 using hive.server2.proxy.user (a.fernandez) apache/superset#3652)
ae8c523 test: add e2e test for universal compiler (Export Dashboard doesn't work apache/superset#3656)
f94b84f chore(deps): update ([SQLLab] Regression: "share query" is broken behind https-only proxy apache/superset#3655)
1923132 test: fix cli
2adfd01 test: fix todo (Add a ColorPickerControl apache/superset#3653)
6e2cbde fix: proxy logging and allow to pass options without the `target` option (Adding sort time table apache/superset#3651)
c9ccc96 fix: respect infastructureLogging.level for client.logging (Time Series Table: group-by keys must be strings apache/superset#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Resource Consumption ('Resource Exhaustion')
🦉 Path Traversal


          fix: superset-frontend/temporary_superset_ui/superset-ui/package.json…

761fa0b

… & superset-frontend/temporary_superset_ui/superset-ui/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-TAR-6476909
- https://snyk.io/vuln/SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet