Skip to content

[YUNIKORN-3268] WEB UI: Update dependencies#273

Closed
wilfred-s wants to merge 1 commit into
apache:masterfrom
wilfred-s:YUNIKORN-3268
Closed

[YUNIKORN-3268] WEB UI: Update dependencies#273
wilfred-s wants to merge 1 commit into
apache:masterfrom
wilfred-s:YUNIKORN-3268

Conversation

@wilfred-s
Copy link
Copy Markdown
Contributor

What is this PR for?

CVEs fixed based on the open dependabot reports.
Regenerated the pnpm-lock.yaml file after the updates

What type of PR is it?

  • - Improvement

What is the Jira issue?

How should this be tested?

Ran a clean build:

  • make test
  • make start-dev

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented May 1, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.66%. Comparing base (b14dbf5) to head (43a9eb4).

Additional details and impacted files
@@           Coverage Diff           @@
##           master     #273   +/-   ##
=======================================
  Coverage   41.66%   41.66%           
=======================================
  Files          61       61           
  Lines        2328     2328           
  Branches      383      383           
=======================================
  Hits          970      970           
  Misses       1165     1165           
  Partials      193      193           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Comment thread package.json Outdated
@wilfred-s wilfred-s marked this pull request as draft May 4, 2026 07:07
@wilfred-s
Copy link
Copy Markdown
Contributor Author

Moving to draft as the changes for security fixes in dependencies will change with the karma to vite PR open #271.
This PR will need a rebase on top of those changes.

CVEs fixed based on the open dependabot reports.
Regenerated the pnpm-lock.yaml file after the updates
@wilfred-s wilfred-s marked this pull request as ready for review May 13, 2026 08:35
Copy link
Copy Markdown
Contributor

@manirajv06 manirajv06 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

Comment thread package.json
"lodash@>=4.0.0 <=4.18.0": "4.18.1",
"hono@<4.12.18": "4.12.18",
"postcss@<8.5.10": "8.5.10",
"picomatch@>=4.0.0 <4.0.4": "4.0.4",
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Only lodash and picomatch are dependencies for karma.

Other dependencies can be updated by updating direct dependencies of which they are part of.

Please see - https://github.com/apache/yunikorn-web/blob/master/README.md#security-fixes

Copy link
Copy Markdown
Contributor

@adityadtu5 adityadtu5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check https://github.com/apache/yunikorn-web/blob/master/README.md#security-fixes. It should be possible to further reduce number of overrides.

@wilfred-s wilfred-s closed this in f43a82d May 13, 2026
@wilfred-s wilfred-s deleted the YUNIKORN-3268 branch May 13, 2026 23:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants