chore(deps): bump uuid, qs, js-yaml, and @cypress/request in frontend lockfiles#40561
chore(deps): bump uuid, qs, js-yaml, and @cypress/request in frontend lockfiles#40561rusackas wants to merge 3 commits into
Conversation
… lockfiles
Resolves several transitive npm advisories in the frontend dev/test
tooling via package.json `overrides`:
superset-frontend:
- uuid: nested 8.3.2 / 9.0.1 (under storybook, jest-junit,
istanbul-lib-processinfo, sockjs) unified to the root's 14.x via
`"uuid": "$uuid"`. These consumers import the named API
(`{ v4 }` / `{ v1 }` / `.v4`), which is unchanged across the bump.
cypress-base:
- uuid -> 11.1.1 (global override)
- qs -> 6.15.2 (clears the moderate and the low advisory)
- @cypress/request -> 3.0.10
- js-yaml -> 4.1.1 scoped under @cypress/code-coverage (the 3.x used by
eslint is intentionally left untouched)
Lockfiles regenerated with `npm install --package-lock-only`; cypress,
eslint, and code-coverage tool versions are unchanged. Runtime behavior
is exercised by CI.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
dosubot
Bot
added
dependencies:npm
javascript
|
Bito Automatic Review Skipped - Files Excluded |
|
Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️ Please read our New Contributor Welcome & Expectations guide. We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #40561 +/- ##
==========================================
- Coverage 64.02% 64.02% -0.01%
==========================================
Files 2648 2648
Lines 142277 142272 -5
Branches 32695 32693 -2
==========================================
- Hits 91092 91088 -4
+ Misses 49627 49626 -1
Partials 1558 1558
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
github-project-automation
Bot
moved this to Needs Review
in Superset Review Help Wanted
4 participants
SUMMARY
Resolves several transitive npm security advisories in the frontend dev/test tooling, surfaced by Dependabot, via
package.jsonoverrides. Grouped because they all live in the two frontend lockfiles.superset-frontend/"uuid": "$uuid"The nested uuid copies are under storybook, jest-junit, istanbul-lib-processinfo, and sockjs. Each imports the named API (
{ v4 },{ v1 },.v4), which is unchanged from uuid 7 onward, so the major bump is API-compatible for these consumers.superset-frontend/cypress-base/(deprecated, Cypress→Playwright migration)@cypress/code-coverage; the 3.x used by eslint is left untouchedNOTES
npm install --package-lock-only(minimal, incremental diffs). Verified thatcypress(11.2.0),eslint(7.32.0), and@cypress/code-coverage(3.10.4) versions are unchanged.TESTING INSTRUCTIONS
npm install --package-lock-onlyresolves cleanly for both lockfilesADDITIONAL INFORMATION
🤖 Generated with Claude Code