Skip to content

ATLAS-5384: Atlas Classic UI: Upgrade UI dependencies for dashboardv2 - #736

Open
Brijesh619 wants to merge 1 commit into
apache:masterfrom
Brijesh619:ATLAS-5384
Open

ATLAS-5384: Atlas Classic UI: Upgrade UI dependencies for dashboardv2#736
Brijesh619 wants to merge 1 commit into
apache:masterfrom
Brijesh619:ATLAS-5384

Conversation

@Brijesh619

Copy link
Copy Markdown
Contributor

What changes were proposed in this pull request?

The legacy dashboardv2 module requires dependency upgrades to address outdated sub-packages and close open Dependabot pull requests. Because dashboardv2 is tied to the older npm v6 build environment via Maven, attempting to upgrade deeply nested sub-dependencies using manual resolutions or overrides is unsupported.

This PR cleanly resolves the outdated dependencies and vulnerabilities by natively upgrading their top-level parent build tools in package.json to exact pinned versions.

Changes include:

  1. Upgraded grunt to 1.6.3 (Inherently pulls in a modernized version of micromatch to resolve picomatch vulnerabilities - PR Bump picomatch from 2.3.1 to 2.3.2 in /dashboardv2/public/js/external_lib/atlas-lineage #588 & PR Bump picomatch from 2.3.1 to 2.3.2 in /dashboardv2 #579).
  2. Upgraded grunt-contrib-connect to 5.0.1 (Inherently pulls in modernized versions of serve-static and send vulnerabilities - PR Bump serve-static from 1.14.1 to 1.16.2 in /dashboardv2 #254 & PR Bump send and serve-static in /dashboardv2 #253).
  3. Upgraded grunt-contrib-cssmin to 4.0.0 (Inherently resolves nested clean-css and trim-newlines vulnerabilities while retaining strict Node 12 compatibility).
  4. Removed ineffective overrides blocks from package.json to rely entirely on native, safe npm dependency resolution.
  5. Regenerated a clean package-lock.json (lockfileVersion: 1) using the strictly enforced Node v12.16.0 / npm v6.13.7 environment.

How was this patch tested?

  • Manual Node/NPM Test: Cleared node_modules and ran npm install inside dashboardv2 using the project-mandated Node v12.16.0 and npm v6.13.7 binaries to guarantee lockfile compatibility.
  • Audit Verification: Ran npm audit to confirm that the picomatch, serve-static, send, clean-css, and trim-newlines vulnerabilities are completely eliminated from the dependency tree.
  • Maven Build Test: Verified the full build passes successfully by running mvn clean -DskipTests -Drat.skip=false package -Pdist,embedded-hbase-solr from the root directory.

@Brijesh619

Copy link
Copy Markdown
Contributor Author
Screenshot from 2026-08-19 17-32-57 Screenshot from 2026-08-19 17-32-25

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant