fix(ui): bump vulnerable transitive npm dependencies - #45
Conversation
Pin brace-expansion, dompurify, shell-quote, @xmldom/xmldom, @babel/plugin-transform-modules-systemjs, @remix-run/router, @babel/runtime, lodash, @babel/helpers, lodash-es, jspdf, and canvg to safe versions via package.json overrides and regenerate package-lock.json. lodash is pinned to 4.18.1 rather than the 4.18.0 remediation version called out in VULN-107502: lodash@4.18.0 is deprecated upstream as a "Bad release", so 4.18.1 (current latest, still >= the required fix) is used instead. Likewise @xmldom/xmldom is pinned to 0.8.14 rather than 0.8.13: the entire 0.8.10-0.8.13 line is deprecated upstream as having "critical issues". Fixes VULN-107633, VULN-107579, VULN-107548, VULN-107532, VULN-107526, VULN-107522, VULN-107503, VULN-107502, VULN-107499, VULN-107496, VULN-107495, VULN-107481
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c5f1fb5b58
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 376cc97e74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa658d2a54
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pin the Splunk Docker image to a fixed version, bump Python to 3.9 and pytest-splunk-addon/ucc-modinput-test in CI, and add a low-disk- space CI config plus a knowledge-test error ignore list so external Splunk instance errors unrelated to the add-on don't fail the run.
Scope the jspdf and react-router-dom version overrides to their actual dependents (@splunk/dashboard-utils and @splunk/add-on-ucc-framework) instead of overriding them globally, map jspdf's ESM build to the UMD build for Jest/jsdom compatibility, and add a regression test for the jsPDF export path.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c580a43b89
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The socks.cpython-37.pyc cleanup step and its README binary declarations targeted Python 3.7 artifacts that no longer apply now that CI builds with Python 3.9.
3 participants
Summary of changes
Remediate 12 vulnerable transitive npm dependencies without upgrading the UCC UI.
@splunk/add-on-ucc-frameworkremains on, and is now pinned to,5.58.0. The npm lockfile was regenerated against the public npm registry.Dependency compatibility
@remix-run/routeroverride with a scopedreact-router-dom@6.30.4override for UCC 5.58.0. This resolves to the coordinatedreact-router@6.30.4and@remix-run/router@1.23.3versions.jspdf@4.2.1to@splunk/dashboard-utils@^28.1.0and add a regression test that exercises the actual dashboard PDF export path.@babel/runtimeto7.28.6, satisfying the minimum required by jsPDF 4.2.1.jest-fixed-jsdomto0.0.11.Runtime and CI updates
splunktaucclib==8.2.0,splunk-sdk==2.1.1,solnlib==7.0.0, andpackaging==24.0. These versions retain Python 3.7 runtime compatibility.pytest-splunk-addonto 5.5.3 andsplunk-add-on-ucc-modinput-testto 2.0.5.splunk/appinspect-cli-actionfrom 2.8 to 2.15.0.SPLUNK_VERSIONoverride..pyccleanup and stale binary declarations. UCC 5.58.0 installs packaged libraries with--no-compile, and the generated Python 3.9 artifact contains no.pycor native.sofiles.Version note: the ticket-requested remediation versions
lodash@4.18.0and@xmldom/xmldom@0.8.13are deprecated upstream. This change uses the next clean versions,lodash@4.18.1and@xmldom/xmldom@0.8.14, which still satisfy the tickets' minimum safe versions.Issue ticket number and link
Fixes VULN-107633, VULN-107579, VULN-107548, VULN-107532, VULN-107526, VULN-107522, VULN-107503, VULN-107502, VULN-107499, VULN-107496, VULN-107495, VULN-107481
Checklist before requesting a review
Testing done
npm ci,npm run lint,npm test, andnpm run buildpre-commitucc-gen buildwith UCC 5.58.0 on Python 3.9.19