pinot-controller uses multiple NPMs that have security issues
- Dominant language
- Java
- Stars
- 6.1k
- Forks
- 1.5k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 189
Description
Dependabot has raised a few PRs but they are just of the problems.
* https://github.com/apache/pinot/pull/8471 (minimist)
* https://github.com/apache/pinot/pull/8470 (axios)
* ansi-regex also has issues (found by dependabot on my github fork - ditto for the following)
* ansi-html
* node-forge
* node-fetch
* url-parse
* postcss
* follow-redirects
* nth-check
* path-parse
* underscore
* sockjs
* dns-packet
* glob-parent
* yargs-parser
* serialize-javascript
Contributor guide
Research direction
Start by reviewing the Dependabot pull requests 8471 and 8470, then inspect how the listed NPM packages are declared in pinot-controller. Resolve the remaining reported package vulnerabilities, including ansi-regex, ansi-html, node-forge, node-fetch, and the other packages listed, and verify that the controller still builds successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100