NIFI-16169 - Address multiple UI dependency security issues.

[rfellows]

NIFI-16169 — UI - Address dependabot and other security related dependency issues

Summary

Metric	Before	After
Critical	0	0
High	14	0
Moderate	15	0
Low	0	0
Total	29	0

Target: nifi-frontend/src/main/frontend/
Node: v24.14.1 · npm: 11.11.0

npm audit now reports 0 vulnerabilities. Fixes landed via a mix of Nx-native framework migrations, direct dependency bumps, and a slimmed-down, verified overrides block.

Dependabot Alert Cross-Reference

Cross-referenced against the live open Dependabot alerts for manifest nifi-frontend/src/main/frontend/package-lock.json
(alerts view),
captured 2026-08-04: 18 open alerts (8 High, 10 Moderate). All are resolved by this pass and will auto-close once the
updated package.json / package-lock.json merge to the default branch.

"Resolution" legend: Fixed = advisory suppressed by an upgrade or override; No longer applicable = the regenerated
dependency graph resolves a patched version on its own (no override required).

High (8)

Alert	Package	GHSA	Resolution	Mechanism
#842	@angular/common	GHSA-jhpw-976m-542j	✅ Fixed	Angular 21.2.17 → 21.2.19 (nx migrate)
#847	@angular/core	GHSA-jj27-h5hq-8x99	✅ Fixed	Angular 21.2.17 → 21.2.19 (nx migrate)
#845	@angular/compiler	GHSA-jj27-h5hq-8x99	✅ Fixed	Angular 21.2.17 → 21.2.19 (nx migrate)
#829	postcss	GHSA-r28c-9q8g-f849	✅ Fixed	postcss → ^8.5.25 (direct dep + nested @angular-devkit/build-angular override)
#839	brace-expansion	GHSA-mh99-v99m-4gvg	✅ Fixed	Per-parent nested overrides (1.1.18 / 2.1.4 / 5.0.9)
#852	undici	GHSA-4cwx-7wf7-3272	✅ Fixed	undici → ^8.10.0 (fix at 8.9.0)
#851	fast-uri	GHSA-7p8r-x3mc-p8w7	✅ No longer applicable	Tree resolves fast-uri@3.1.5 (patched); override removed
#830	js-yaml	GHSA-pm4m-ph32-ghv5	✅ No longer applicable	Tree resolves js-yaml@4.3.1 (patched); override removed

Moderate (10)

Alert	Package	GHSA	Resolution	Mechanism
#836	nx	GHSA-g2r8-wvmj-jf5w	✅ Fixed	Nx 22.5.4 → 22.7.8 (nx migrate)
#814	@hono/node-server	GHSA-frvp-7c67-39w9	✅ Fixed	@hono/node-server → ^2.0.5 (resolved 2.0.12) + @modelcontextprotocol/sdk → ^1.30.0
#808	webpack-dev-server	GHSA-m28w-2pqf-7qgj	✅ Fixed	webpack-dev-server → ^5.2.6 (also targeted by PR #11466)
#809	webpack-dev-server	GHSA-f5vj-f2hx-8m93	✅ Fixed	webpack-dev-server → ^5.2.6 (also targeted by PR #11466)
#853	undici	GHSA-8xcm-r25x-g524	✅ Fixed	undici → ^8.10.0 (fix at 8.9.0)
#854	undici	GHSA-v3r7-h72x-cjcm	✅ Fixed	undici → ^8.10.0 (fix at 8.9.0)
#855	undici	GHSA-jr45-8vmc-qm54	✅ Fixed	undici → ^8.10.0 (fix at 8.9.0)
#856	undici	GHSA-m8rv-5g2x-5cg5	✅ Fixed	undici → ^8.10.0 (fix at 8.9.0)
#857	ip-address	GHSA-22jq-vg5j-6vgg	✅ No longer applicable	Tree resolves ip-address@10.4.0 (fix at 10.2.1); no override needed
#858	ip-address	GHSA-4xrf-jv44-h6hh	✅ No longer applicable	Tree resolves ip-address@10.4.0 (fix at 10.2.2); no override needed

18 alerts → all resolved. 13 are Fixed via upgrade/override; 4 are No longer applicable (fast-uri, js-yaml, and both
ip-address alerts) because the regenerated lockfile already resolves patched versions without an override.

Note on counts: the live Dependabot list (18 alerts, captured after several advisories were published in the ~24h before
this pass) is larger than the initial baseline npm audit (29 advisory rows, but only 14 unique GHSAs at that snapshot). The
extra alerts — the 3 newest undici moderates and both ip-address moderates — were published after the baseline snapshot;
they are all still covered by the undici override bump and the lockfile regeneration respectively. A fresh npm audit
against the current tree confirms 0 vulnerabilities.

Related PR

Dependabot alerts #808 / #809 both reference PR #11466, an existing
webpack-dev-server bump. The webpack-dev-server → ^5.2.6 override in this pass supersedes it; that PR can be closed once
this work merges.

Actions Taken (chronological)

1. Transitive overrides — bumped ineffective pins & added new ones

• undici >=7.28.0 → ^8.10.0; js-yaml >=4.3.0 → ^5.2.3 (later removed, see prune); fast-uri >=3.1.4 → ^4.1.2 (later removed); webpack-dev-server >=5.2.5 → ^5.2.6; postcss direct dep ^8.5.10 → ^8.5.25 + nested @angular-devkit/build-angular override.
• New: brace-expansion (nested per parent — flat ^5.0.9 broke Nx, which relies on the pre-5.x default-export API), @hono/node-server ^2.0.5, @modelcontextprotocol/sdk ^1.30.0.
• Removed 13 stale overrides that no longer suppressed any advisory (flatted, lodash-es, tar, websocket-driver, axios, immutable, shell-quote, svgo, hono, body-parser, dompurify, rollup, top-level ajv).

2. Framework bumps via Nx-native tooling (approved)

• Nx 22.5.4 → 22.7.8 — npx nx migrate 22.7.8 → npx nx migrate --run-migrations. Migrations were benign: 4 .gitignore/.prettierignore additions and one @nx/eslint:lint executor-input update in nx.json. Resolved all 10 Nx-family alerts.
• Angular 21.2.17 → 21.2.19 — npx nx migrate @angular/core@21.2.19 (patch bump, no code migrations). ng update is unavailable in this Nx-native workspace (no angular.json). Resolved all 9 Angular alerts, including the two production-facing XSS / cache-poisoning issues.
• Regenerated package-lock.json (clean reinstall) to clear a transient peer-dep state after the coordinated Angular bump.
• Pinned prettier ~3.8.3 — the clean reinstall drifted prettier 3.8.3 → 3.9.6 within its ^3.2.5 range, and 3.9 reformats short type unions, flagging two pre-existing files. Pinning avoids unrelated formatting churn in a security PR.

3. Overrides prune (tidy-up)

Batch prune (clear overrides, reinstall, re-audit → 40 advisories surface) confirmed which entries are load-bearing. Removed 8 now-stale entries; kept 17. Net: 25 → 17 override keys.

• Removed: koa (not in tree), js-yaml (natural 4.3.1), fast-uri (natural 3.1.5), ws (natural 8.21.2), adm-zip (natural 0.6.0), and the three *.ajv nested pins (natural resolution already supplies eslint's ajv 6.x).
• Kept for API-compat (not security): nx.minimatch ^9.0.9 and @nx/devkit.minimatch ^9.0.9. Dropping them let minimatch@10.x in, whose ESM entry does import { expand } from 'brace-expansion' — a named export absent from the brace-expansion@2.1.4 we pin under nx, breaking Nx at runtime (brace_expansion_1.expand is not a function).

Final overrides block (17 keys)

"overrides": {
    "eslint": { "brace-expansion": "^5.0.9" },
    "@eslint/eslintrc": { "brace-expansion": "^1.1.18" },
    "serialize-javascript": "^7.0.3",
    "nx": { "minimatch": "^9.0.9", "brace-expansion": "^2.1.4" },
    "@nx/devkit": { "minimatch": "^9.0.9", "brace-expansion": "^2.1.4" },
    "@nx/angular": { "brace-expansion": "^2.1.4" },
    "@angular/cli": { "brace-expansion": "^5.0.9" },
    "@typescript-eslint/parser": { "brace-expansion": "^5.0.9" },
    "undici": "^8.10.0",
    "picomatch": "^4.0.4",
    "@babel/core": "^7.29.7",
    "sockjs": { "uuid": "^11.1.1" },
    "@angular-devkit/build-angular": { "postcss": "^8.5.25" },
    "webpack-dev-server": "^5.2.6",
    "http-proxy-middleware": "^3.0.7",
    "piscina": "^5.2.0",
    "vite": "^7.3.5",
    "@hono/node-server": "^2.0.5",
    "@modelcontextprotocol/sdk": "^1.30.0"
}

Files Changed

File	Change
package.json	Angular 9 deps → 21.2.19; Nx 4 devDeps → 22.7.8; postcss → ^8.5.25; prettier → ~3.8.3; overrides rewritten (25 → 17)
package-lock.json	Regenerated
nx.json	@nx/eslint:lint inputs (from nx migrate)
.gitignore, .prettierignore	.nx/* and .claude/* entries (from nx migrate)

Verification

cd nifi-frontend/src/main/frontend && npx nx run-many -t lint,test,build --parallel=3 --skip-nx-cache

• lint — 6 projects — ✔ pass
• test — 6 projects — 325 test files, 2748 tests passed
• build — 6 projects — bundle generation complete
• npm audit — 0 vulnerabilities

[mcgilman]

Reviewing...

[mcgilman]

Thanks for the PR @rfellows!