Skip to content

[SPARK-55740][TESTS] Fix npm vulnerabilities by npm audit fix#54538

Closed
LuciferYang wants to merge 2 commits intoapache:masterfrom
LuciferYang:SPARK-55740
Closed

[SPARK-55740][TESTS] Fix npm vulnerabilities by npm audit fix#54538
LuciferYang wants to merge 2 commits intoapache:masterfrom
LuciferYang:SPARK-55740

Conversation

@LuciferYang
Copy link
Contributor

What changes were proposed in this pull request?

This pr fix the following npm vulnerabilities by npm audit fix in ui-test/ and dev/ directory:

  • ui-test
npm audit report
# npm audit report

minimatch  <=3.1.3 || 9.0.0 - 9.0.6 || 10.0.0 - 10.2.2
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@jest/reporters/node_modules/minimatch
node_modules/jest-config/node_modules/minimatch
node_modules/jest-runtime/node_modules/minimatch
node_modules/minimatch
node_modules/test-exclude/node_modules/minimatch

1 high severity vulnerability

To address all issues, run:
  npm audit fix
  • dev
npm audit report                                     
# npm audit report

ajv  <6.14.0 || >=7.0.0-alpha.0 <8.18.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix`
node_modules/ajv
node_modules/table/node_modules/ajv

minimatch  <=3.1.3
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/minimatch

2 vulnerabilities (1 moderate, 1 high)

To address all issues, run:
  npm audit fix

Why are the changes needed?

Fix npm vulnerabilities in ui-test/ and dev/ directory.

Does this PR introduce any user-facing change?

No

How was this patch tested?

  • Pass GitHub Actions

Was this patch authored or co-authored using generative AI tooling?

No

@LuciferYang LuciferYang changed the title [SPARK-55740][TESTS] [SPARK-55740][TESTS] Fix npm vulnerabilities by npm audit fix Feb 27, 2026
Copy link
Member

@dongjoon-hyun dongjoon-hyun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1, LGTM (Pending CIs).

@sarutak sarutak closed this in 72225dd Feb 27, 2026
@sarutak
Copy link
Member

sarutak commented Feb 27, 2026

Merged to master. Thank you @LuciferYang and @dongjoon-hyun !

@LuciferYang
Copy link
Contributor Author

Thank you @sarutak and @dongjoon-hyun

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants