Repository navigation
fix(ui): bump vulnerable transitive npm dependencies - #45
Conversation
Pin brace-expansion, dompurify, shell-quote, @xmldom/xmldom, @babel/plugin-transform-modules-systemjs, @remix-run/router, @babel/runtime, lodash, @babel/helpers, lodash-es, jspdf, and canvg to safe versions via package.json overrides and regenerate package-lock.json. lodash is pinned to 4.18.1 rather than the 4.18.0 remediation version called out in VULN-107502: lodash@4.18.0 is deprecated upstream as a "Bad release", so 4.18.1 (current latest, still >= the required fix) is used instead. Likewise @xmldom/xmldom is pinned to 0.8.14 rather than 0.8.13: the entire 0.8.10-0.8.13 line is deprecated upstream as having "critical issues". Fixes VULN-107633, VULN-107579, VULN-107548, VULN-107532, VULN-107526, VULN-107522, VULN-107503, VULN-107502, VULN-107499, VULN-107496, VULN-107495, VULN-107481
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c5f1fb5b58
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 376cc97e74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa658d2a54
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pin the Splunk Docker image to a fixed version, bump Python to 3.9 and pytest-splunk-addon/ucc-modinput-test in CI, and add a low-disk- space CI config plus a knowledge-test error ignore list so external Splunk instance errors unrelated to the add-on don't fail the run.
Scope the jspdf and react-router-dom version overrides to their actual dependents (@splunk/dashboard-utils and @splunk/add-on-ucc-framework) instead of overriding them globally, map jspdf's ESM build to the UMD build for Jest/jsdom compatibility, and add a regression test for the jsPDF export path.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c580a43b89
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The socks.cpython-37.pyc cleanup step and its README binary declarations targeted Python 3.7 artifacts that no longer apply now that CI builds with Python 3.9.
## Summary Fixes the remaining vulnerable UUID copy found while reassessing [VULN-109578](https://splunk.atlassian.net/browse/VULN-109578), CVE-2026-41907. The existing remediation upgraded the top-level UUID dependency to 11.1.1. The development dependency chain `webpack-dev-server -> sockjs@0.3.24 -> uuid@8.3.2` still introduced an affected copy. - Add a scoped npm override for `sockjs@0.3.24` to use UUID 11.1.1. - Regenerate `ui/package-lock.json`; the nested UUID 8.3.2 entry is removed and SockJS resolves the existing UUID 11.1.1 copy. - Use `chore:` because the changed dependency belongs to development server tooling. ## Why a scoped override SockJS 0.3.24 is the current upstream version and still declares UUID `^8.3.2`. Every available webpack-dev-server 5.x version, including 5.2.7, retains SockJS `^0.3.24`. A lockfile refresh or parent update within that major cannot select the patched UUID version. SockJS calls `require('uuid').v4()` without arguments. UUID 11.1.1 retains the CommonJS export and this API. The override is limited to this exact SockJS version. Upstream advisory: GHSA-w5hq-g745-h8pq ## Validation - `npm install --package-lock-only --ignore-scripts --no-audit --no-fund --registry=https://registry.npmjs.org` completed successfully. - Inspected every UUID lockfile entry: only 11.1.1 remains. - Compared every installed dependency copy relevant to all 27 Example TA findings against the affected ranges in their 21 current upstream advisories; no matching affected version remains in this branch. - Inspected the published SockJS 0.3.24 source and UUID 11.1.1 export metadata for the API compatibility described above. - `git diff --check` passed. No unit tests, lint, production build, or runtime compatibility tests were run for this patch. CI results remain to be reviewed; pipeline completion was not awaited. ## Jira Keep VULN-109578 open until this follow-up fix is merged and the target branch is rechecked. The other 26 queue findings were already fixed by merged PRs #45–#48 and have been reclosed separately with `Resolved / upgraded_to_safe_version` after current-branch and advisory verification. Prepared with AI assistance.
Summary of changes
Remediate 12 vulnerable transitive npm dependencies without upgrading the UCC UI.
@splunk/add-on-ucc-frameworkremains on, and is now pinned to,5.58.0. The npm lockfile was regenerated against the public npm registry.Dependency compatibility
@remix-run/routeroverride with a scopedreact-router-dom@6.30.4override for UCC 5.58.0. This resolves to the coordinatedreact-router@6.30.4and@remix-run/router@1.23.3versions.jspdf@4.2.1to@splunk/dashboard-utils@^28.1.0and add a regression test that exercises the actual dashboard PDF export path.@babel/runtimeto7.28.6, satisfying the minimum required by jsPDF 4.2.1.jest-fixed-jsdomto0.0.11.Runtime and CI updates
splunktaucclib==8.2.0,splunk-sdk==2.1.1,solnlib==7.0.0, andpackaging==24.0. These versions retain Python 3.7 runtime compatibility.pytest-splunk-addonto 5.5.3 andsplunk-add-on-ucc-modinput-testto 2.0.5.splunk/appinspect-cli-actionfrom 2.8 to 2.15.0.SPLUNK_VERSIONoverride..pyccleanup and stale binary declarations. UCC 5.58.0 installs packaged libraries with--no-compile, and the generated Python 3.9 artifact contains no.pycor native.sofiles.Version note: the ticket-requested remediation versions
lodash@4.18.0and@xmldom/xmldom@0.8.13are deprecated upstream. This change uses the next clean versions,lodash@4.18.1and@xmldom/xmldom@0.8.14, which still satisfy the tickets' minimum safe versions.Issue ticket number and link
Fixes VULN-107633, VULN-107579, VULN-107548, VULN-107532, VULN-107526, VULN-107522, VULN-107503, VULN-107502, VULN-107499, VULN-107496, VULN-107495, VULN-107481
Checklist before requesting a review
Testing done
npm ci,npm run lint,npm test, andnpm run buildpre-commitucc-gen buildwith UCC 5.58.0 on Python 3.9.19