Solve critical vulnerability of Presto UI from @babel/traverse npm package#21322
Merged
tdcmeehan merged 1 commit intoprestodb:masterfrom Nov 13, 2023
Merged
Solve critical vulnerability of Presto UI from @babel/traverse npm package#21322tdcmeehan merged 1 commit intoprestodb:masterfrom
@babel/traverse npm package#21322tdcmeehan merged 1 commit intoprestodb:masterfrom
Conversation
Update @babel and related packages to newer versions to solve the critical vulnerability issue reported by `yarn audit`: https://www.npmjs.com/advisories/1094446 Signed-off-by: Yihong Wang <yh.wang@ibm.com>
Member
Author
Member
Author
tdcmeehan
approved these changes
Nov 6, 2023
skairali
approved these changes
Nov 9, 2023
Member
skairali
left a comment
There was a problem hiding this comment.
This is a good change and required one from security perspective.
Contributor
|
If this is a "critical vulnerability" as described in the title, consider adding a release note to this PR for the Security section of the next release notes. |
Member
Author
|
@steveburnett thanks for the feedback. update the description of this PR to include the release node. |
26 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.


Ref: #21319
Description
Update @babel and related packages to newer versions to solve the critical vulnerability issue reported by
yarn audit: GHSA-67hx-6x53-jw92Motivation and Context
The critical vulnerability issue reported by
yarn auditmay impact servers that run the babel to compile the Presto UI code or developers' machines. Although there is nopath.evaluate()orpath.evaluateTruthy()in the current code base, it's good to fix it.Impact
Most of the JS files are not changed, except
query.js.Test Plan
Manually run the Presto UI and verify the query page.
Contributor checklist
Release Notes
Please follow release notes guidelines and fill in the release notes below.