Skip to content

refactor(flux): migrate Flux details panel to bui (@backstage/ui)#1984

Merged
marians merged 5 commits into
mainfrom
refactor/flux-details-panel-bui
Jul 23, 2026
Merged

refactor(flux): migrate Flux details panel to bui (@backstage/ui)#1984
marians merged 5 commits into
mainfrom
refactor/flux-details-panel-bui

Conversation

@marians

@marians marians commented Jul 23, 2026

Copy link
Copy Markdown
Member

What does this PR do?

Migrates the Flux details panel — the body rendered inside DetailsPane when a resource is selected in the tree/list view — and the full ResourceCard component tree from legacy @material-ui/core + makeStyles to bui (@backstage/ui). This is the first Flux → bui PR.

  • Rebuilds the panel frame (Section, Details, and the Kustomization/HelmRelease/Repository/ImageAutomation detail components) on bui Flex/Box/Text.
  • Migrates the ResourceCard tree (ResourceCard/ResourceWrapper, ResourceInfo, ResourceHeading, ResourceStatus, ResourceChips, ResourceMetadata, CopyCommandMenu). CopyCommandMenu now uses the bui MenuTrigger/Menu with a ButtonIcon trigger.
  • Resource cards are now collapsible bui Accordions (expanded by default): the name/kind/status row is the trigger, metadata/actions are the revealable panel. The card keeps its rounded corners and status-colored background (including the not-ready tint), the resource name is a bold heading, the status and type/namespace indicators are bui Badges, and the caret is aligned top-right.
  • The card's custom theme-aware background colors and the per-kind resource-type color coding are intentionally kept in colocated makeStyles, as bui has no equivalent tokens.

What is the effect of this change to users?

Visual refresh of the Flux details panel; no behavioural change. Because ResourceWrapper/ResourceInfo are shared with the tree-view node, panel-only styling is gated behind an emphasized flag so the tree view keeps its original appearance (its full migration is a follow-up PR).

How does it look like?

Verified live in the running app (light + dark) via DevTools. Collapsible cards with rounded corners, not-ready rose tint, bold heading, color-coded type badge, and neutral namespace/status badges.

Any background context you can provide?

First step of the incremental Flux → bui migration. DetailsPane shell (in ui-react) and the tree-view node are out of scope here.

Do the docs need to be updated?

No.

Should this change be mentioned in the release notes?

  • A changeset describing the change and affected packages was added. (more info)

@marians
marians requested a review from a team as a code owner July 23, 2026 04:55
Migrate the Flux details panel and the full ResourceCard tree from legacy
@material-ui/core + makeStyles to bui (@backstage/ui). Resource cards are now
collapsible Accordions (expanded by default) with a bold heading, status/kind/
namespace badges, and the not-ready background tint preserved. Per-kind color
coding is kept on the resource-type badge, and the shared tree-view node keeps
its original appearance (panel-only styling is gated behind an `emphasized`
flag). Adds render tests for Details, ResourceCard, and CopyCommandMenu.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@marians
marians force-pushed the refactor/flux-details-panel-bui branch from c94cf5b to f7ff8ef Compare July 23, 2026 04:57
<Accordion
id={`${kind}-${namespace ?? ''}-${name}`}
className={classes.accordion}
defaultExpanded

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The card is an uncontrolled Accordion (defaultExpanded, no isExpanded), and defaultExpanded only applies on mount. DetailsPane/FluxResourceDetails/Details render this card in place without a key tied to the resource identity, so navigating between two resources of the same kind (e.g. Kustomization → Kustomization) keeps the same Accordion instance mounted. If the user collapsed the previous card, the new resources card stays collapsed instead of expanding by default. Consider keying the card (or Details/the detail component) by the resource ref so it re-mounts and re-applies defaultExpanded.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 31d8654 — the Accordion is now keyed by the resource identity (kind-namespace-name-cluster), so it re-mounts and re-applies defaultExpanded when the panel switches to a different resource of the same kind. Verified live: collapsed a HelmRelease card, navigated to another HelmRelease, and the new card came up expanded again.

const color = inactive ? 'secondary' : 'primary';
// The details panel (emphasized) gets a larger, bold heading; the tree-view
// node keeps its original, smaller size until it is migrated separately.
const as = emphasized ? 'h4' : 'div';

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In emphasized mode ResourceHeading renders <Text as="h4">, and this heading is placed inside AccordionTrigger, which (react-aria Disclosure) wraps its children in a <button> nested in a <Heading>. That yields <h3><button>…<h4>name</h4>…</button></h3> — a heading nested in a button nested in a heading. This is invalid HTML (a <button> may only contain phrasing content, and headings should not nest) and can confuse screen readers. Browsers tolerate it, but consider as="div" (or a non-heading element) for the emphasized title inside the trigger.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 31d8654 — the emphasized title now renders as a div (keeping the bold weight for the visual heading look) instead of h4, so there is no longer a heading nested inside the trigger <button>. Verified in the a11y tree that the AccordionTrigger button contains no heading elements.

<TerminalIcon fontSize="small" />
)
}
aria-label="Copy CLI command"

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The copy button lost its tooltip in the migration. The old code wrapped the button in a MUI <Tooltip title="Copy CLI command">; now there is only aria-label, which is not shown on hover. ButtonIcon does not render a visible tooltip from aria-label on its own, so sighted users lose the affordance label. Consider wrapping in bui TooltipTrigger/Tooltip.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 31d8654 — wrapped the ButtonIcon in bui TooltipTrigger/Tooltip. Verified live: hovering shows the "Copy CLI command" tooltip and the button now has a matching aria-describedby, and opening the menu still works with TooltipTrigger nested inside MenuTrigger.

fixedKeyColumnWidth="120px"
/>
<Accordion
id={`${kind}-${namespace ?? ''}-${name}`}

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Accordion id is derived from kind/namespace/name only (not cluster). Each ResourceCard is a standalone Disclosure whose id drives the panel id and the trigger aria-controls. If the same kind+namespace+name identity appears in two cards on one panel (e.g. the primary "This X" card and a related/dependency card referring to the same object), the DOM ids collide — invalid HTML and mis-wired aria-controls. Including cluster (already part of the React key used for dependency cards) would make it unique.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in 31d8654 — the Accordion id now includes cluster (kind-namespace-name-cluster), matching the React key already used for dependency cards, so the ids stay unique even when the same kind+namespace+name identity appears in more than one card on a panel.

marians and others added 4 commits July 23, 2026 07:25
- Restore the copy button's tooltip ("Copy CLI command") via bui
  TooltipTrigger/Tooltip; aria-label alone was not shown on hover.
- Render the emphasized card title as a `div` instead of `h4`: it lives inside
  the AccordionTrigger's <button> (wrapped in a react-aria heading), and a
  heading nested in a button nested in a heading is invalid HTML.
- Include the cluster in the Accordion id so it stays unique when the same
  kind+namespace+name identity appears in more than one card on a panel.
- Key the Accordion by the resource identity so it re-mounts and re-applies
  `defaultExpanded` when the panel switches between resources of the same kind.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The node-build job runs `ci:verify` = tsc (--max-old-space-size=6144),
lint:all, and test:all --coverage (131 suites) concurrently, which peaked near
the xlarge 16 GB ceiling and OOM-killed the job intermittently (fast failure,
no step logs, green locally). Bump the resource_class from xlarge to 2xlarge
(32 GB) for headroom.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2xlarge is not available on this org's CircleCI plan (xlarge is the Docker
ceiling), so the generated config was rejected at validation and the build
workflow failed in ~2s. Restore xlarge to keep the pipeline runnable.
node-build runs tsc (--max-old-space-size=6144), lint:all, and test:all
--coverage concurrently. On xlarge (16 GB) the combined peak reached the
ceiling and OOM-killed the job intermittently (fast failure, no step logs,
green locally). 2xlarge is not available on this org's CircleCI plan, so trim
the Jest footprint instead: --maxWorkers 50%->40% (fewer concurrent workers on
the 8-vCPU box) and --workerIdleMemoryLimit 1536MB->1024MB. Kept percentage-
based so local full-test runs on larger machines are not crippled.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

JS Dependency Audit

0 added · 0 removed · 207 total (0 vs base)

Projects audited
  • . (manager: yarn-berry)
  • ./packages/app (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./packages/backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./packages/backend-common (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./packages/backend-headless-service (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/agent-platform (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/ai-chat (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/ai-chat-backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/ai-chat-react (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/auth-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/catalog-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/error-reporter-react (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/flux (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/flux-react (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/gs (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/gs-backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/gs-common (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/gs-node (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/kubernetes-react (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/muster (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/muster-backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/plans (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/plans-backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/roadmap (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/roadmap-backend (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/scaffolder-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/techdocs-backend-module-gs (manager: unknown) — skipped on PR head: no recognized lockfile
  • ./plugins/ui-react (manager: unknown) — skipped on PR head: no recognized lockfile

No change in vulnerabilities compared to the base branch.

Full current vulnerability list (207)
  • 🔴 critical cipher-base (<=1.0.4) — cipher-base is missing type checks, leading to hash rewind and passing on crafted data advisory
  • 🔴 critical elliptic (<=6.6.0) — Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) advisory
  • 🔴 critical handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion advisory
  • 🔴 critical pbkdf2 (>=3.0.10 <=3.1.2) — pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos advisory
  • 🔴 critical pbkdf2 (>=1.0.0 <=3.1.2) — pbkdf2 silently disregards Uint8Array input, returning static keys advisory
  • 🔴 critical shell-quote (>=1.1.0 <=1.8.3) — shell-quote quote() does not escape newlines in object .op values advisory
  • 🟠 high @backstage/backend-defaults (<0.12.2) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
  • 🟠 high @backstage/plugin-scaffolder-node (>=0.12.0 <0.12.3) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
  • 🟠 high @backstage/plugin-scaffolder-node (<0.11.2) — Backstage has a Possible Symlink Path Traversal in Scaffolder Actions advisory
  • 🟠 high @grpc/grpc-js (>=1.14.0 <1.14.4) — @grpc/grpc-js: A malformed request can cause a server crash advisory
  • 🟠 high @grpc/grpc-js (>=1.14.0 <1.14.4) — @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash advisory
  • 🟠 high @hono/node-server (<1.19.10) — @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware advisory
  • 🟠 high adm-zip (<0.6.0) — adm-zip: Crafted ZIP file triggers 4GB memory allocation advisory
  • 🟠 high axios (>=1.15.2 <1.18.0) — Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning advisory
  • 🟠 high axios (>=0.31.1 <0.33.0) — Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning advisory
  • 🟠 high brace-expansion (>=2.0.0 <2.1.2) — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups advisory
  • 🟠 high brace-expansion (<1.1.16) — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups advisory
  • 🟠 high brace-expansion (>=3.0.0 <5.0.7) — brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups advisory
  • 🟠 high fast-uri (<=3.1.0) — fast-uri vulnerable to path traversal via percent-encoded dot segments advisory
  • 🟠 high fast-uri (<=3.1.1) — fast-uri vulnerable to host confusion via percent-encoded authority delimiters advisory
  • 🟠 high fast-uri (>=3.0.0 <=3.1.3) — fast-uri vulnerable to host confusion via literal backslash authority delimiter advisory
  • 🟠 high fast-uri (>=3.0.0 <3.1.3) — fast-uri vulnerable to host confusion via failed IDN canonicalization advisory
  • 🟠 high fast-xml-parser (>=4.0.0-beta.3 <4.5.5) — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) advisory
  • 🟠 high fast-xml-parser (>=5.0.0 <5.5.6) — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) advisory
  • 🟠 high flatted (<3.4.0) — flatted vulnerable to unbounded recursion DoS in parse() revive phase advisory
  • 🟠 high flatted (<=3.4.1) — Prototype Pollution via parse() in NodeJS flatted advisory
  • 🟠 high glob (>=10.2.0 <10.5.0) — glob CLI: Command injection via -c/--cmd executes matches with shell:true advisory
  • 🟠 high glob (>=11.0.0 <11.1.0) — glob CLI: Command injection via -c/--cmd executes matches with shell:true advisory
  • 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block advisory
  • 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial advisory
  • 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation advisory
  • 🟠 high handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options advisory
  • 🟠 high hono (<4.12.25) — hono: CORS Middleware reflects any Origin with credentials when origin defaults to the wildcard advisory
  • 🟠 high immutable (<3.8.3) — Immutable is vulnerable to Prototype Pollution advisory
  • 🟠 high immutable (<4.3.9) — Immutable.js List 32-bit trie overflow → unrecoverable DoS advisory
  • 🟠 high immutable (<4.3.9) — Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set advisory
  • 🟠 high js-yaml (>=4.0.0 <4.3.0) — js-yaml: YAML merge-key chains can force quadratic CPU consumption advisory
  • 🟠 high js-yaml (>=3.0.0 <3.15.0) — js-yaml: YAML merge-key chains can force quadratic CPU consumption advisory
  • 🟠 high jsonata (<2.2.0) — jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion advisory
  • 🟠 high jws (=4.0.0) — auth0/node-jws Improperly Verifies HMAC Signature advisory
  • 🟠 high jws (<3.2.3) — auth0/node-jws Improperly Verifies HMAC Signature advisory
  • 🟠 high linkify-it (<=5.0.0) — LinkifyIt#match scan loop has quadratic algorithmic complexity advisory
  • 🟠 high linkify-it (<=5.0.1) — linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text advisory
  • 🟠 high lodash (>=4.0.0 <=4.17.23) — lodash vulnerable to Code Injection via _.template imports key names advisory
  • 🟠 high lodash-es (>=4.0.0 <=4.17.23) — lodash vulnerable to Code Injection via _.template imports key names advisory
  • 🟠 high path-to-regexp (>=8.0.0 <8.4.0) — path-to-regexp vulnerable to Denial of Service via sequential optional groups advisory
  • 🟠 high picomatch (<2.3.2) — Picomatch has a ReDoS vulnerability via extglob quantifiers advisory
  • 🟠 high picomatch (>=4.0.0 <4.0.4) — Picomatch has a ReDoS vulnerability via extglob quantifiers advisory
  • 🟠 high shell-quote (<=1.8.4) — shell-quote: Quadratic-complexity Denial of Service in parse() (CWE-407) advisory
  • 🟠 high svgo (>=1.0.0 <2.8.3) — SVGO removeScripts plugin leaves some executable scripts intact advisory
  • 🟠 high tmp (<0.2.6) — tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape advisory
  • 🟠 high underscore (<=1.13.7) — Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack advisory
  • 🟡 moderate @babel/runtime (<7.26.10) — Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups advisory
  • 🟡 moderate @backstage/backend-common (0.25.0) — This package is deprecated, please follow the deprecation instructions for the exports you still use
  • 🟡 moderate @backstage/cli-common (<=0.1.16) — @backstage/cli-common has a possible resolveSafeChildPath Symlink Chain Bypass advisory
  • 🟡 moderate @backstage/plugin-circleci (0.3.35) — This package has been moved to the to the https://github.com/CircleCI-Public/backstage-plugin repository. You should migrate to using that instead.
  • 🟡 moderate @fortawesome/react-fontawesome (0.2.6) — v0.2.x is no longer supported. Unless you are still using FontAwesome 5, please update to v3.1.1 or greater.
  • 🟡 moderate @hono/node-server (<1.19.13) — @hono/node-server: Middleware bypass via repeated slashes in serveStatic advisory
  • 🟡 moderate @hono/node-server (<2.0.5) — Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) advisory
  • 🟡 moderate @humanwhocodes/config-array (0.13.0) — Use @eslint/config-array instead
  • 🟡 moderate @humanwhocodes/object-schema (2.0.3) — Use @eslint/object-schema instead
  • 🟡 moderate @material-ui/core (4.12.4) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
  • 🟡 moderate @material-ui/lab (4.0.0-alpha.61) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
  • 🟡 moderate @material-ui/pickers (3.3.11) — This package no longer supported. It has been relaced by @mui/x-date-pickers
  • 🟡 moderate @material-ui/styles (4.11.5) — Material UI v4 doesn't receive active development since September 2021. See the guide https://mui.com/material-ui/migration/migration-v4/ to upgrade to v5.
  • 🟡 moderate @octokit/endpoint (>=9.0.5 <9.0.6) — @octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
  • 🟡 moderate @octokit/plugin-paginate-rest (>=1.0.0 <9.2.2) — @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
  • 🟡 moderate @octokit/plugin-paginate-rest (>=9.3.0-beta.1 <11.4.1) — @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
  • 🟡 moderate @octokit/request (>=1.0.0 <8.4.1) — @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
  • 🟡 moderate @octokit/request-error (>=1.0.0 <5.1.1) — @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking advisory
  • 🟡 moderate @react-hookz/deep-equal (1.0.4) — PACKAGE IS DEPRECATED AND WILL BE DETED SOON, USE @ver0/deep-equal INSTEAD
  • 🟡 moderate @rjsf/material-ui (5.24.13) — Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
  • 🟡 moderate @sentry/browser (<7.119.1) — Sentry SDK Prototype Pollution gadget in JavaScript SDKs advisory
  • 🟡 moderate @types/http-proxy-middleware (1.0.0) — This is a stub types definition. http-proxy-middleware provides its own type definitions, so you do not need this installed.
  • 🟡 moderate @types/keyv (4.2.0) — This is a stub types definition. keyv provides its own type definitions, so you do not need this installed.
  • 🟡 moderate @ungap/structured-clone (1.3.0) — Potential CWE-502 - Update to 1.3.1 or higher
  • 🟡 moderate atlassian-openapi (1.0.19) — DEPRECATED: atlassian-openapi has moved to @atlassian/atlassian-openapi. The latest version is 1.0.6. Please update your dependency.
  • 🟡 moderate axios (>=1.0.0 <1.18.0) — Axios: Excessive recursion in formDataToJSON can cause denial of service advisory
  • 🟡 moderate axios (>=0.28.0 <0.33.0) — Axios: Excessive recursion in formDataToJSON can cause denial of service advisory
  • 🟡 moderate axios (>=1.15.2 <1.18.0) — Axios: Prototype pollution auth subfields can inject Basic auth advisory
  • 🟡 moderate axios (>=1.0.0 <1.18.0) — Axios: Deep formToJSON Key Recursion Can Cause Denial of Service advisory
  • 🟡 moderate axios (>=0.28.0 <0.33.0) — Axios: Deep formToJSON Key Recursion Can Cause Denial of Service advisory
  • 🟡 moderate axios (>=1.7.0 <1.18.0) — Axios: Fetch adapter ReadableStream uploads bypass maxBodyLength advisory
  • 🟡 moderate axios (<0.33.0) — Axios: Prototype pollution gadgets can alter axios request construction advisory
  • 🟡 moderate axios (>=1.0.0 <1.18.0) — Axios: Prototype pollution gadgets can alter axios request construction advisory
  • 🟡 moderate axios (>=0.31.0 <0.33.0) — Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios advisory
  • 🟡 moderate axios (>=1.15.0 <1.18.0) — Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios advisory
  • 🟡 moderate axios (>=1.15.1 <1.18.0) — Axios form serializer maxDepth bypass via {} metatoken advisory
  • 🟡 moderate axios (>=0.31.1 <0.33.0) — Axios form serializer maxDepth bypass via {} metatoken advisory
  • 🟡 moderate axios (>=1.0.0 <1.18.0) — Axios: Nested axios option objects can consume polluted prototype values advisory
  • 🟡 moderate axios (>=0.8.0 <0.33.0) — Axios: Nested axios option objects can consume polluted prototype values advisory
  • 🟡 moderate axios (>=1.13.0 <1.18.0) — Axios: HTTP/2 streamed uploads bypass maxBodyLength advisory
  • 🟡 moderate bn.js (>=5.0.0 <5.2.3) — bn.js affected by an infinite loop advisory
  • 🟡 moderate bn.js (<4.12.3) — bn.js affected by an infinite loop advisory
  • 🟡 moderate boolean (3.2.0) — Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
  • 🟡 moderate brace-expansion (<1.1.13) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
  • 🟡 moderate brace-expansion (>=2.0.0 <2.0.3) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
  • 🟡 moderate brace-expansion (>=4.0.0 <5.0.5) — brace-expansion: Zero-step sequence causes process hang and memory exhaustion advisory
  • 🟡 moderate brace-expansion (>=5.0.0 <5.0.6) — brace-expansion: Large numeric range defeats documented max DoS protection advisory
  • 🟡 moderate core-js (2.6.12) — core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
  • 🟡 moderate dompurify (>=3.1.3 <3.2.7) — DOMPurify contains a Cross-site Scripting vulnerability advisory
  • 🟡 moderate dompurify (>=3.1.3 <=3.3.1) — DOMPurify contains a Cross-site Scripting vulnerability advisory
  • 🟡 moderate dompurify (<=3.3.1) — DOMPurify ADD_ATTR predicate skips URI validation advisory
  • 🟡 moderate dompurify (<=3.3.1) — DOMPurify USE_PROFILES prototype pollution allows event handlers advisory
  • 🟡 moderate dompurify (<=3.3.3) — DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation advisory
  • 🟡 moderate dompurify (<3.4.0) — DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) advisory
  • 🟡 moderate dompurify (>=1.0.10 <3.4.0) — DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode advisory
  • 🟡 moderate dompurify (>=3.0.1 <3.4.0) — DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback advisory
  • 🟡 moderate dompurify (<3.3.2) — DOMPurify is vulnerable to mutation-XSS via Re-Contextualization advisory
  • 🟡 moderate dompurify (<3.4.7) — DOMPurify: Hook mutation of data.allowedTags / data.allowedAttributes permanently pollutes DEFAULT_ALLOWED_TAGS / DEFAULT_ALLOWED_ATTR advisory
  • 🟡 moderate dompurify (<=3.4.5) — DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound instanceof checks advisory
  • 🟡 moderate dompurify (<=3.4.5) — DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM advisory
  • 🟡 moderate dompurify (<=3.4.6) — DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside .content advisory
  • 🟡 moderate dompurify (<=3.4.10) — DOMPurify: Permanent ALLOWED_ATTR pollution via setConfig() bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch) advisory
  • 🟡 moderate eslint (8.57.1) — This version is no longer supported. Please see https://eslint.org/version-support for other options.
  • 🟡 moderate fast-xml-parser (>=5.0.0 <5.5.7) — Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser advisory
  • 🟡 moderate fast-xml-parser (>=4.0.0-beta.3 <4.5.5) — Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser advisory
  • 🟡 moderate fast-xml-parser (<5.7.0) — fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters advisory
  • 🟡 moderate file-type (>=13.0.0 <21.3.1) — file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header advisory
  • 🟡 moderate follow-redirects (<=1.15.11) — follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets advisory
  • 🟡 moderate glob (7.2.3) — Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
  • 🟡 moderate handlebars (>=4.0.0 <4.7.9) — Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection advisory
  • 🟡 moderate handlebars (>=4.6.0 <=4.7.8) — Handlebars.js has a Prototype Method Access Control Gap via Missing lookupSetter Blocklist Entry advisory
  • 🟡 moderate har-validator (5.1.5) — this library is no longer supported
  • 🟡 moderate hono (<4.12.12) — Hono missing validation of cookie name on write path in setCookie() advisory
  • 🟡 moderate hono (<4.12.12) — Hono: Non-breaking space prefix bypass in cookie name handling in getCookie() advisory
  • 🟡 moderate hono (>=4.0.0 <=4.12.11) — Hono: Path traversal in toSSG() allows writing files outside the output directory advisory
  • 🟡 moderate hono (<4.12.12) — Hono: Middleware bypass via repeated slashes in serveStatic advisory
  • 🟡 moderate hono (<4.12.12) — Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses advisory
  • 🟡 moderate hono (<4.12.18) — Hono has CSS Declaration Injection via Style Object Values in JSX SSR advisory
  • 🟡 moderate hono (<4.12.18) — Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage advisory
  • 🟡 moderate hono (<4.12.16) — Hono: bodyLimit() can be bypassed for chunked / unknown-length requests advisory
  • 🟡 moderate hono (<4.12.16) — hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection advisory
  • 🟡 moderate hono (<4.12.21) — Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 advisory
  • 🟡 moderate hono (<4.12.21) — Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection advisory
  • 🟡 moderate hono (<4.12.21) — Hono: JWT middleware accepts any Authorization scheme, not only Bearer advisory
  • 🟡 moderate hono (<4.12.21) — Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths advisory
  • 🟡 moderate hono (<4.12.14) — hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR advisory
  • 🟡 moderate hono (<4.12.25) — hono: Body Limit Middleware can be bypassed on AWS Lambda by understating Content-Length advisory
  • 🟡 moderate hono (<4.12.25) — hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest advisory
  • 🟡 moderate hono (<4.12.25) — hono: Path traversal in serve-static on Windows via encoded backslash (%5C) advisory
  • 🟡 moderate hono (<4.12.25) — hono: AWS Lambda adapter merges multiple Set-Cookie headers into one value, dropping cookies on ALB single-header and Lattice advisory
  • 🟡 moderate hono (>=4.3.3 <4.12.27) — Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication advisory
  • 🟡 moderate hono (>=4.11.8 <4.12.27) — hono/jsx does not isolate context per request, leading to cross-request data disclosure advisory
  • 🟡 moderate hono (>=4.0.0 <4.12.27) — Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility advisory
  • 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.5) — http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed advisory
  • 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.4) — http-proxy-middleware can call writeBody twice because "else if" is not used advisory
  • 🟡 moderate http-proxy-middleware (>=0.16.0 <2.0.10) — http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass advisory
  • 🟡 moderate http-proxy-middleware (>=3.0.0 <3.0.6) — http-proxy-middleware router host+path substring matching allows Host-header-driven backend routing bypass advisory
  • 🟡 moderate inflight (1.0.6) — This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
  • 🟡 moderate ip-address (<=10.1.0) — ip-address has XSS in Address6 HTML-emitting methods advisory
  • 🟡 moderate js-yaml (<3.15.0) — JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases advisory
  • 🟡 moderate js-yaml (>=4.0.0 <=4.1.1) — JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases advisory
  • 🟡 moderate launch-editor (<=2.14.0) — launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows advisory
  • 🟡 moderate lodash (<=4.17.23) — lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit advisory
  • 🟡 moderate lodash-es (<=4.17.23) — lodash vulnerable to Prototype Pollution via array path bypass in _.unset and _.omit advisory
  • 🟡 moderate lodash-es (>=4.0.0 <=4.17.22) — Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions advisory
  • 🟡 moderate lodash.get (4.4.2) — This package is deprecated. Use the optional chaining (?.) operator instead.
  • 🟡 moderate lodash.isequal (4.5.0) — This package is deprecated. Use require('node:util').isDeepStrictEqual instead.
  • 🟡 moderate markdown-it (>=13.0.0 <14.1.1) — markdown-it is has a Regular Expression Denial of Service (ReDoS) advisory
  • 🟡 moderate markdown-it (<=14.1.1) — markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations advisory
  • 🟡 moderate morgan (>=1.2.0 <=1.10.1) — morgan vulnerable to Log Forging via unneutralized control characters in :remote-user advisory
  • 🟡 moderate nanoid (<3.3.8) — Predictable results in nanoid generation when given non-integer values advisory
  • 🟡 moderate node-domexception (1.0.0) — Use your platform's native DOMException instead
  • 🟡 moderate path-to-regexp (>=8.0.0 <8.4.0) — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards advisory
  • 🟡 moderate picomatch (<2.3.2) — Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching advisory
  • 🟡 moderate picomatch (>=4.0.0 <4.0.4) — Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching advisory
  • 🟡 moderate postcss (<8.5.10) — PostCSS has XSS via Unescaped </style> in its CSS Stringify Output advisory
  • 🟡 moderate prebuild-install (7.1.3) — No longer maintained. Please contact the author of the relevant native addon; alternatives are available.
  • 🟡 moderate prismjs (<1.30.0) — PrismJS DOM Clobbering vulnerability advisory
  • 🟡 moderate qs (<6.14.1) — qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion advisory
  • 🟡 moderate qs (>=6.11.1 <=6.15.1) — qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set advisory
  • 🟡 moderate react-beautiful-dnd (13.1.1) — react-beautiful-dnd is now deprecated. Context and options: react-beautiful-dnd is now deprecated atlassian/react-beautiful-dnd#2672
  • 🟡 moderate request (<=2.88.2) — Server-Side Request Forgery in Request advisory
  • 🟡 moderate rimraf (3.0.2) — Rimraf versions prior to v4 are no longer supported
  • 🟡 moderate stable (0.1.8) — Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility
  • 🟡 moderate tough-cookie (<4.1.3) — tough-cookie Prototype Pollution vulnerability advisory
  • 🟡 moderate uuid (<11.1.1) — uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided advisory
  • 🟡 moderate webpack-dev-server (<=5.2.3) — webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins advisory
  • 🟡 moderate webpack-dev-server (<5.2.5) — webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies advisory
  • 🟡 moderate webpack-dev-server (<=5.2.5) — webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints advisory
  • 🟡 moderate webpack-dev-server (<=5.2.5) — webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header advisory
  • 🟡 moderate yaml (>=1.0.0 <1.10.3) — yaml is vulnerable to Stack Overflow via deeply nested YAML collections advisory
  • 🟡 moderate yaml (>=2.0.0 <2.8.3) — yaml is vulnerable to Stack Overflow via deeply nested YAML collections advisory
  • 🔵 low @babel/core (<=7.29.0) — @babel/core: Arbitrary File Read via sourceMappingURL Comment advisory
  • 🔵 low @backstage/backend-defaults (<0.12.2) — Backstage has a Possible SSRF when reading from allowed URL's in backend.reading.allow advisory
  • 🔵 low @backstage/integration (<=1.20.0) — Backstage vulnerable to potential reading of SCM URLs using built in token advisory
  • 🔵 low @smithy/config-resolver (<4.4.0) — AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value advisory
  • 🔵 low @tootallnate/once (<2.0.1) — @tootallnate/once vulnerable to Incorrect Control Flow Scoping advisory
  • 🔵 low body-parser (>=2.0.0 <2.3.0) — body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement advisory
  • 🔵 low body-parser (<1.20.6) — body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement advisory
  • 🔵 low brace-expansion (>=1.0.0 <=1.1.11) — brace-expansion Regular Expression Denial of Service vulnerability advisory
  • 🔵 low brace-expansion (>=2.0.0 <=2.0.1) — brace-expansion Regular Expression Denial of Service vulnerability advisory
  • 🔵 low cookie (<0.7.0) — cookie accepts cookie name, path, and domain with out of bounds characters advisory
  • 🔵 low diff (>=4.0.0 <4.0.4) — jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch advisory
  • 🔵 low diff (>=5.0.0 <5.2.2) — jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch advisory
  • 🔵 low dompurify (<=3.4.6) — DOMPurify: IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects advisory
  • 🔵 low dompurify (<3.4.9) — DOMPurify: Trusted Types policy survives clearConfig() and can poison later RETURN_TRUSTED_TYPE output advisory
  • 🔵 low dompurify (>=3.0.0 <=3.4.7) — DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside content when using DOM output modes advisory
  • 🔵 low dompurify (<=3.4.11) — DOMPurify: CUSTOM_ELEMENT_HANDLING bypasses afterSanitizeElements for allowed custom elements. advisory
  • 🔵 low elliptic (<6.6.0) — Valid ECDSA signatures erroneously rejected in Elliptic advisory
  • 🔵 low elliptic (<=6.6.1) — Elliptic Uses a Cryptographic Primitive with a Risky Implementation advisory
  • 🔵 low esbuild (>=0.27.3 <0.28.1) — esbuild allows arbitrary file read when running the development server on Windows advisory
  • 🔵 low handlebars (>=4.0.0 <=4.7.8) — Handlebars.js has a Property Access Validation Bypass in container.lookup advisory
  • 🔵 low hono (<4.12.18) — Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() advisory
  • 🔵 low on-headers (<1.1.0) — on-headers is vulnerable to http response header manipulation advisory
  • 🔵 low tmp (<=0.2.3) — tmp allows arbitrary temporary file / directory write via symbolic link dir parameter advisory

@marians
marians merged commit d29ac2a into main Jul 23, 2026
11 checks passed
@marians
marians deleted the refactor/flux-details-panel-bui branch July 23, 2026 07:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant