Repository navigation
[MINOR] Refresh frontend Node.js and audit dependencies - #5587
Merged
Merged
Conversation
tbonelee
approved these changes
Oct 24, 2026
Contributor
|
Merged into master (d8da8f3). |
3 of 4 tasks
voidmatcha
pushed a commit
that referenced
this pull request
Oct 24, 2026
### What is this PR for? Follow up on #5587 by updating the remaining Node.js toolchains to patched releases. The [October 2026 Node.js security release](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high) addresses the Brotli decoder vulnerability CVE-2026-111497. - Upgrade Classic UI builds from Node.js 16.20.2 to 22.23.4, aligning Maven, nvm, and package engine metadata. - Upgrade Helium bundle generation from Node.js 16.16.0 to 22.23.4. - Restrict the Angular/React frontend engine range to patched release lines: `^22.23.4 || ^24.22.1 || >=26.12.1`. The existing Classic npm 8.19.4 and Helium npm 8.11.0/Yarn 1.22.0 versions are retained. Application code and dependency resolutions are unchanged apart from the Node.js version selection and engine metadata. Classic uses Node.js during development and builds; Helium also invokes Node.js on the server to install packages and generate bundles. This updates those toolchains without claiming a confirmed remotely exploitable Zeppelin attack path. ### What type of PR is it? Bug Fix ### Todos - [x] Validate Classic UI builds and tests on Node.js 22.23.4 - [x] Validate Helium installation, bundle generation, rendering, and cache reuse - [x] Validate integration with the #5587 frontend toolchain - [ ] Confirm GitHub Actions results ### What is the Jira issue? N/A ### How should this be tested? Frontend: - Clean installation with Node.js 22.23.4 and npm 11.21.1. - React tests: 262 passed. - React typecheck and React/Angular production builds passed. - Existing braces security patch applied successfully. Classic UI: - Production build and 194 browser unit tests passed. - Browser checks covered notebook editing, execution, table/chart rendering, search/replace, and interpreter permission settings. - The development server connected to the backend successfully. Helium: - Five Helium tests passed, and the server reactor build passed with JDK 11. - Installed and enabled the horizontalbar example, generated its bundle with Node.js 22.23.4, and verified the SVG chart and values in a notebook. - On Linux x86-64, verified automatic replacement of an existing Node.js 16.16.0 installation, bundle loading, forced rebuild, and reuse after server restart. - The Markdown Spell example installed, bundled, and rendered, but result persistence encountered an existing Java ClassCastException. Equivalent bundles built with Node.js 16.20.2 and 22.23.4 were byte-identical. The browser checks also identified an existing Monaco icon font loading error, reproduced with a Node.js 22.21.1 comparison build. These existing issues are outside this change. The retained Node.js changes are identical to the previously validated versions. After integration with #5587, installation, React tests, typecheck, and frontend builds were repeated. The source tree was unchanged by rebasing onto the merged #5587 commit. The full E2E suite, Storybook build, and final WAR/container packaging were not rerun. ### Screenshots (if appropriate) N/A ### Questions: * Does the license files need to update? No. * Is there breaking changes for older versions? Builds require a patched Node.js release. Maven downloads Node.js 22.23.4 for Classic UI builds, and Helium installs that version for bundle generation. * Does this needs documentation? Yes; the Classic UI Local Development instructions now point to the Node.js version pinned in `.nvmrc`. Closes #5588 from tbonelee/fix/brotli-security-after-5587. Signed-off-by: YONGJAE LEE <dev.yongjaelee@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR for?
Update the Angular/React frontend toolchain to Node.js 22.23.4 for upstream security fixes, including DNS null-byte input validation (CVE-2026-105482) and
realpathSyncpermission-model checks (CVE-2026-106073). Pin npm 11.21.1 in Maven and both audit workflows to avoid the npm 10.9.4edgesOutcrash in the scheduled audit remediation job.Update Storybook to 10.6.3, Vitest to 4.1.12, and vulnerable transitive dependencies. Keep the existing audit policy and braces patch verification. Retain npm debug logs for three days on failure to diagnose internal errors such as
edgesOut.The Angular root audit exclusion and classic UI Node.js versions remain outside this change.
What type of PR is it?
Bug Fix
Todos
What is the Jira issue?
N/A
How should this be tested?
Use Node.js 22.23.4 and npm 11.21.1. From
zeppelin-web-angular/:Then, from
zeppelin-web-angular/projects/zeppelin-react/:npm ci --ignore-scripts --no-audit npm run apply:patches npm run audit npm audit fix --package-lock-only --ignore-scripts --audit-level=high npm run lint npm test npm run typecheck npm run buildLocal checks passed: React audit, 262 tests, lint, typecheck, builds, and Maven toolchain installation. GitHub CI and the Docker documentation build remain unverified.
Screenshots (if appropriate)
N/A
Questions: