apache / apache/pinot

pinot-controller uses multiple NPMs that have security issues

Open
#8,476 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
6.1k
Forks
1.5k
Avg merge
1d 21h
Merged PRs (30d)
189

Description

Dependabot has raised a few PRs but they are just of the problems.

* https://github.com/apache/pinot/pull/8471 (minimist)
* https://github.com/apache/pinot/pull/8470 (axios)
* ansi-regex also has issues (found by dependabot on my github fork - ditto for the following)
* ansi-html
* node-forge
* node-fetch
* url-parse
* postcss
* follow-redirects
* nth-check
* path-parse
* underscore
* sockjs
* dns-packet
* glob-parent
* yargs-parser
* serialize-javascript

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the Dependabot pull requests 8471 and 8470, then inspect how the listed NPM packages are declared in pinot-controller. Resolve the remaining reported package vulnerabilities, including ansi-regex, ansi-html, node-forge, node-fetch, and the other packages listed, and verify that the controller still builds successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
build-system, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.