apache/pinot

Upgrade UI related libraries to address vulnerabilities

Open

#13975 opened on Sep 10, 2024

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Java (4,937 stars) (1,234 forks)batch import
dependenciesgood first issuehelp wanteduivulnerability

Description

See https://github.com/apache/pinot/security/dependabot for details

Contributor guide

Tech stack
javascripttypescriptreact
Domain
frontendsecurity
Issue type
security
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Basic knowledge of npm/yarnFamiliarity with package.json
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65
Research direction
The issue references Dependabot alerts for UI libraries. Check the linked security page for specific vulnerabilities. Locate the UI source code (likely under pinot controller/src/main/resources/webapp) and update the affected dependencies in package.json. Run `npm audit` to confirm fixes and ensure no breaking changes by running the UI tests. If no tests exist, manually verify the UI loads correctly.