[
https://issues.apache.org/jira/browse/HBASE-30494?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Dávid Paksy updated HBASE-30494:
--------------------------------
Fix Version/s: 4.0.0-alpha-1
Hadoop Flags: Reviewed
Resolution: Fixed
Status: Resolved (was: Patch Available)
Merged the patch to master.
Many thanks [~liuxiaocs] for the review!
> Upgrade @vitest, body-parser, fast-uri, happy-dom in website to fix known
> security vulnerabilities
> --------------------------------------------------------------------------------------------------
>
> Key: HBASE-30494
> URL: https://issues.apache.org/jira/browse/HBASE-30494
> Project: HBase
> Issue Type: Task
> Components: dependencies, security
> Reporter: Dávid Paksy
> Assignee: Dávid Paksy
> Priority: Major
> Labels: pull-request-available
> Fix For: 4.0.0-alpha-1
>
>
> npm aufit before:
>
> {noformat}
> npm audit
> # npm audit report
> @vitest/mocker <=4.1.11
> Severity: moderate
> Vitest: Code injection via unauthenticated manual mock registration -
> https://github.com/advisories/GHSA-qxg6-89mg-rqv8
> Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect
> allowlist fix - https://github.com/advisories/GHSA-xp26-3454-mjgp
> fix available via `npm audit fix`
> node_modules/@vitest/mocker
> vitest 2.1.0-beta.1 - 4.1.11
> Depends on vulnerable versions of @vitest/mocker
> node_modules/vitest
> body-parser 2.0.0 - 2.3.0
> Severity: high
> body-parser vulnerable to Denial of Service via trailing bytes after a
> compressed request body - https://github.com/advisories/GHSA-27r3-jxmh-p828
> fix available via `npm audit fix`
> node_modules/body-parser
> compression <1.8.2
> Severity: high
> compression vulnerable to Denial of Service via memory leak on premature
> response close - https://github.com/advisories/GHSA-vc2v-76pw-4v95
> fix available via `npm audit fix --force`
> Will install [email protected], which is a breaking change
> node_modules/compression
> serve >=10.1.0
> Depends on vulnerable versions of compression
> node_modules/serve
> fast-uri 3.0.0 - 3.1.8
> Severity: moderate
> fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme
> decoding - https://github.com/advisories/GHSA-w74x-v6f9-j3xg
> fast-uri vulnerable to improper path equivalence in relative reference
> normalization - https://github.com/advisories/GHSA-xhq7-xmqj-769h
> fast-uri vulnerable to host confusion via unchecked WHATWG host
> canonicalization - https://github.com/advisories/GHSA-wjr9-j795-jxcr
> fast-uri vulnerable to scheme injection via an unescaped first-segment colon
> in suffix references - https://github.com/advisories/GHSA-333x-w4r6-6crp
> fix available via `npm audit fix`
> node_modules/fast-uri
> happy-dom 17.0.0 - 21.0.3
> Severity: high
> Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads
> to host code execution - https://github.com/advisories/GHSA-834v-8h66-3h79
> fix available via `npm audit fix --force`
> Will install [email protected], which is a breaking change
> node_modules/happy-dom
> katex 0.11.0 - 0.18.1
> KaTeX: Existing prototype pollution can bypass trust restrictions -
> https://github.com/advisories/GHSA-238p-pmpm-9mq7
> fix available via `npm audit fix --force`
> Will install [email protected], which is a breaking change
> node_modules/micromark-extension-math/node_modules/katex
> node_modules/rehype-katex/node_modules/katex
> micromark-extension-math *
> Depends on vulnerable versions of katex
> node_modules/micromark-extension-math
> remark-math >=4.0.0
> Depends on vulnerable versions of micromark-extension-math
> node_modules/remark-math
> rehype-katex >=2.0.0
> Depends on vulnerable versions of katex
> node_modules/rehype-katex
> postcss-selector-parser <7.1.6
> Severity: moderate
> PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
> - https://github.com/advisories/GHSA-rj75-hqrm-r3gf
> fix available via `npm audit fix --force`
> Will install @tailwindcss/[email protected], which is a breaking change
> node_modules/postcss-selector-parser
> @tailwindcss/typography <=0.0.0-insiders.fda8ce5 || >=0.5.5
> Depends on vulnerable versions of postcss-selector-parser
> node_modules/@tailwindcss/typography
> zod <4.6.6
> Severity: high
> Zod can exhaust memory while validating oversized constrained collections -
> https://github.com/advisories/GHSA-mrhx-c7xc-m3w5
> fix available via `npm audit fix`
> node_modules/zod
> 14 vulnerabilities (4 low, 5 moderate, 5 high)
> To address issues that do not require attention, run:
> npm audit fix
> To address all issues (including breaking changes), run:
> npm audit fix --force
> {noformat}
>
> After the fix:
> {noformat}
> 9 vulnerabilities (4 low, 2 moderate, 3 high)
> {noformat}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
