[FLINK-39516][runtime-web] Address npm security advisories in flink-runtime-web web-dashboard - #28000
Closed
spuru9 wants to merge 6 commits into
Closed
[FLINK-39516][runtime-web] Address npm security advisories in flink-runtime-web web-dashboard#28000spuru9 wants to merge 6 commits into
spuru9 wants to merge 6 commits into
Conversation
Contributor
Author
|
As of April 22, 2026 |
Collaborator
spuru9
marked this pull request as ready for review
April 22, 2026 20:28
Contributor
Author
|
@rmetzger PR for the cleanup of vulnerabilities as discussed. |
…reformatting Prettier 2.5 introduced a space-before-colon rule for Angular pipe arguments, which reformatted ~25 component templates as a side effect of the dep upgrade. The reformat is purely cosmetic but spreads the diff across many files, raising merge-conflict risk against concurrent template work. Pin prettier to ~2.4.1 (matching master prior to the upgrade — devDep only, no advisory exposure per npm audit) and restore the template files to master content. NOTE: package-lock.json and NOTICE will be regenerated in a follow-up commit (npm install + generate_notice.sh) once registry auth is refreshed.
Contributor
Author
|
Pinned the prettier version. Reducing unintended whitespace changes. |
Contributor
Author
|
FYI: There have been a few advisories generated in last few days post this PR creation. Not expanding the scope of the PR as some of them dont have clean fix yet. Would be good to add later. All are of MODERATE level only. |
Contributor
Author
|
@snuyanzin Can you look at this PR as well, these are the venerability fixes in the webui. |
Contributor
Author
|
Similar to the comment in #28147 (comment) by @snuyanzin Moved all the details of the CVEs to a file in my fork https://github.com/spuru9/flink/blob/npm-fix-advisories-details-1/flink-runtime-web/ADVISORIES_FIX_PR_28000.md |
Contributor
Author
A lot of dependency PR have been generated recently, should I refresh this PR or it can be picked in a seperate PR later.
|
spuru9
changed the title
MartijnVisser
added a commit
to MartijnVisser/flink
that referenced
this pull request
Jun 30, 2026
…#28000 Raise the declared package.json minimums for the non-Angular dependencies to the secure versions identified in FLINK-39516 / apache#28000, so the declared floors match the versions the lockfile already resolves. No change to the shipped artifact (resolved versions are unchanged); this hardens the declared minimums against future lockfile regeneration. Co-Authored-By: Purushottam Sinha <sinhapurushottam911@gmail.com> Generated-by: Claude Opus 4.8 (1M context)
1 task
MartijnVisser
added a commit
to MartijnVisser/flink
that referenced
this pull request
Jul 1, 2026
…#28000 Raise the declared package.json minimums for the non-Angular dependencies to the secure versions identified in FLINK-39516 / apache#28000, so the declared floors match the versions the lockfile already resolves. No change to the shipped artifact (resolved versions are unchanged). Co-Authored-By: Purushottam Sinha <sinhapurushottam911@gmail.com> Generated-by: Claude Opus 4.8 (1M context)
MartijnVisser
added a commit
that referenced
this pull request
Jul 1, 2026
… v21 (#28593) * [FLINK-40028][runtime-web] Update Angular to v21 and ng-zorro-antd to v21 Upgrade the web dashboard to the latest LTS Angular (21.2.17) and the matching stable ng-zorro-antd (21.3.2), with TypeScript 5.9, the aligned @angular-eslint/@typescript-eslint toolchain, and @types/node 22. Regenerate the lockfile (resolving the outstanding npm security advisories) and the previously stale NOTICE. Pin prettier to master's 2.6.2 to avoid license-header reformatting drift, and keep templates on *ngIf/*ngFor by disabling prefer-control-flow; the control-flow migration, prettier 3 and eslint 9 are a dedicated follow-up. Generated-by: Claude Opus 4.8 (1M context) * [FLINK-40028][runtime-web] Remove obsolete husky env var and update Node prerequisite The HUSKY_SKIP_INSTALL env var and the deprecated 'npm ci --cache-max=0 --no-save' flags are obsolete: husky was removed in FLINK-33939 and the flags are no-ops under npm 10. Bump the documented Node minimum to match Angular 21's floor. Generated-by: Claude Opus 4.8 (1M context) * [FLINK-40028][runtime-web] Adopt secure dependency floors from #28000 Raise the declared package.json minimums for the non-Angular dependencies to the secure versions identified in FLINK-39516 / #28000, so the declared floors match the versions the lockfile already resolves. No change to the shipped artifact (resolved versions are unchanged). Co-Authored-By: Purushottam Sinha <sinhapurushottam911@gmail.com> Generated-by: Claude Opus 4.8 (1M context) --------- Co-authored-by: Purushottam Sinha <sinhapurushottam911@gmail.com>
Contributor
|
Superseded by #28593 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of the change
The purpose of this pull request is to address multiple npm security advisories in the
flink-runtime-web'sweb-dashboard. This is achieved by upgrading several dependencies to their latest secure versions, including a major upgrade of the Angular framework and related libraries.Brief change log
@angular/*packages from18.xto20.1.3.package-lock.jsonto resolve numerous SemVer-compatible and major security advisories.flink-runtime-web/src/main/resources/META-INF/NOTICEfile to reflect the new dependency versions and added/removed packages.Precedence: [FLINK-36740] [WebFrontend] Update frontend dependencies to address vulnerabilities #25718
Verifying this change
This change is primarily a dependency upgrade to resolve security issues. It can be verified by:
web-dashboardbuilds successfully (npm run build).npm run lint).Does this pull request potentially affect one of the following parts:
@Public(Evolving): noDocumentation
Was generative AI tooling used to co-author this PR?
Generated-by: Gemini CLI 0.37.2