From 91090572c567b63309ecce04bca09e284e18c098 Mon Sep 17 00:00:00 2001 From: ChanHo Lee Date: Sat, 24 Oct 2026 21:57:47 +0900 Subject: [PATCH 1/4] Require patched Node.js release lines in frontend engine metadata --- zeppelin-web-angular/package-lock.json | 2 +- zeppelin-web-angular/package.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/zeppelin-web-angular/package-lock.json b/zeppelin-web-angular/package-lock.json index d59bed52eec..25c0a77f693 100644 --- a/zeppelin-web-angular/package-lock.json +++ b/zeppelin-web-angular/package-lock.json @@ -91,7 +91,7 @@ "ws": "8.22.0" }, "engines": { - "node": ">=22.12.0" + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" } }, "node_modules/@algolia/abtesting": { diff --git a/zeppelin-web-angular/package.json b/zeppelin-web-angular/package.json index 67838599f29..9f899297f9d 100644 --- a/zeppelin-web-angular/package.json +++ b/zeppelin-web-angular/package.json @@ -53,7 +53,7 @@ "e2e:cleanup": "npx tsx e2e/cleanup-util.ts" }, "engines": { - "node": ">=22.12.0" + "node": "^22.23.4 || ^24.22.1 || >=26.12.1" }, "private": true, "dependencies": { From f6c6ca9fb1f27c72139ccd750be16c9583e4c2a7 Mon Sep 17 00:00:00 2001 From: ChanHo Lee Date: Sat, 24 Oct 2026 21:00:34 +0900 Subject: [PATCH 2/4] Move classic UI builds to patched Node.js 22.23.4 Replace the end-of-life Node.js 16 pin to address CVE-2026-111497. Keep npm 8.19.4 and all resolved package versions unchanged to isolate the runtime migration. Validation: Maven Node/npm installation; npm ci; npm run build:dist (including lint); npm run karma-test with FirefoxHeadless, 194 tests passed. No OpenSSL legacy provider or webpack changes required. --- zeppelin-web/.nvmrc | 2 +- zeppelin-web/package-lock.json | 2 +- zeppelin-web/package.json | 2 +- zeppelin-web/pom.xml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/zeppelin-web/.nvmrc b/zeppelin-web/.nvmrc index 0af79149663..1a5acc8c372 100644 --- a/zeppelin-web/.nvmrc +++ b/zeppelin-web/.nvmrc @@ -8,4 +8,4 @@ # See the License for the specific language governing permissions and # limitations under the License. -16.20.2 +22.23.4 diff --git a/zeppelin-web/package-lock.json b/zeppelin-web/package-lock.json index 78454256ea1..704ab376d03 100644 --- a/zeppelin-web/package-lock.json +++ b/zeppelin-web/package-lock.json @@ -125,7 +125,7 @@ "webpack-dev-server": "^4.15.2" }, "engines": { - "node": "~16.20.2", + "node": "~22.23.4", "npm": "~8.19.4" } }, diff --git a/zeppelin-web/package.json b/zeppelin-web/package.json index 484fe4a4318..17c5bdb9c36 100644 --- a/zeppelin-web/package.json +++ b/zeppelin-web/package.json @@ -3,7 +3,7 @@ "license": "Apache-2.0", "version": "0.0.0", "engines": { - "node": "~16.20.2", + "node": "~22.23.4", "npm": "~8.19.4" }, "scripts": { diff --git a/zeppelin-web/pom.xml b/zeppelin-web/pom.xml index b9295680462..bc05a41f8b0 100644 --- a/zeppelin-web/pom.xml +++ b/zeppelin-web/pom.xml @@ -38,7 +38,7 @@ https://nodejs.org/dist/ https://registry.npmjs.org/npm/-/ - v16.20.2 + v22.23.4 8.19.4 test From 7ccdf09feabed18f423f0fd8c824568cde462873 Mon Sep 17 00:00:00 2001 From: ChanHo Lee Date: Sat, 24 Oct 2026 21:00:34 +0900 Subject: [PATCH 3/4] Use patched Node.js 22.23.4 for Helium bundles Replace the end-of-life Node.js 16.16.0 installed by the runtime Helium bundler to address CVE-2026-111497. Retain the current npm, Yarn and webpack versions. Validation: JDK 11 Maven package reactor for zeppelin-server --am with HeliumBundleFactoryTest: 5 tests passed, covering tool installation, npm package download, local and registry bundles, cache reuse and package version switching. --- .../java/org/apache/zeppelin/helium/HeliumBundleFactory.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java b/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java index f6e9389633f..7af9bbee789 100644 --- a/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java +++ b/zeppelin-server/src/main/java/org/apache/zeppelin/helium/HeliumBundleFactory.java @@ -70,7 +70,7 @@ */ public class HeliumBundleFactory { private static final Logger LOGGER = LoggerFactory.getLogger(HeliumBundleFactory.class); - private static final String NODE_VERSION = "v16.16.0"; + private static final String NODE_VERSION = "v22.23.4"; private static final String NPM_VERSION = "8.11.0"; private static final String YARN_VERSION = "v1.22.0"; private static final String NPM_PACKAGE_NAME = "npm"; From 157e360928d9018493891bbb9f0ed2fe54e13356 Mon Sep 17 00:00:00 2001 From: ChanHo Lee Date: Sat, 24 Oct 2026 23:32:57 +0900 Subject: [PATCH 4/4] Point Classic UI development documentation to the pinned Node.js version --- zeppelin-web/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zeppelin-web/README.md b/zeppelin-web/README.md index 4023f14d873..ac16f370b83 100644 --- a/zeppelin-web/README.md +++ b/zeppelin-web/README.md @@ -6,7 +6,7 @@ This is Zeppelin's frontend project. ### Local Development -It is recommended to install [Node.js](https://nodejs.org) v16 or use [creationix/nvm](https://github.com/creationix/nvm). +Use the [Node.js](https://nodejs.org) version pinned in [.nvmrc](./.nvmrc) for local development. You can manage this version with [nvm](https://github.com/nvm-sh/nvm). All build commands are described in [package.json](./package.json)