Repository navigation
fix: patch vulnerable website dependencies - #2788
Rana Singh (ranadeepsingh) merged 1 commit into
Conversation
## Summary Update eleven website dependencies to patched releases and add security and compatibility regressions. Bundle KaTeX CSS from the renderer package. ## Prompting Intent Fix vulnerabilities shown in the SynapseML GitHub dependency graph, create a PR, and validate it through the SynapseML PR loop. The user explicitly scoped the work to the website dependency list and excluded environment.yml. ## Linked Sources - https://github.com/microsoft/SynapseML/network/dependencies - GHSA-pqg4-j6r4-53mv - GHSA-238p-pmpm-9mq7 - GHSA-5gmw-xhrv-c9v3 - GHSA-85c8-ppgw-ccpr - GHSA-vfj7-8cjw-p6xm - Remaining advisory identifiers are recorded in the PR's dependency table. ## Rationale Retain Docusaurus 3.10.2 and use targeted npm overrides instead of the downgrades proposed by npm audit fix --force. Exercise the existing CSS pipeline and worker-data contract where patched versions cross major lines. The shell-quote and KaTeX regressions fail with the original lockfile. Do not suppress the remaining braces advisory: no patched release exists. Dependency-only change; no ADO feature task applies. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ceb8ba3c-97f0-4fcf-ae29-a2c9a40c103d
Rana Singh (ranadeepsingh)
added
the
dependencies
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Hey Rana Singh (@ranadeepsingh) 👋! We use semantic commit messages to streamline the release process. Examples of commit messages with semantic prefixes:
To test your commit locally, please follow our guild on building from source. |
|
/azp run |
|
Azure Pipelines: Successfully started running 1 pipeline(s). |
There was a problem hiding this comment.
🔵 Needs a closer look
Cross-major dependency overrides require human review supported by a completed production website build and successful CI evidence, neither of which is supplied yet.
No open issues 🎉
1 file not reviewed
website/package-lock.json: Generated file
What changed in this PR
This PR updates vulnerable dependencies in SynapseML’s documentation website while retaining Docusaurus 3.10.2 and leaving Python/Spark dependencies unchanged.
Changes:
- Updates 11 affected packages through targeted overrides and lockfile regeneration.
- Bundles KaTeX CSS with the installed renderer and adds security and compatibility regression tests.
- Documents the unresolved
bracesadvisory without claiming a clean audit.
| File | Description |
|---|---|
| website/test/dependencySecurity.test.js | Adds shell-quoting, math-rendering, CSS, and worker-pool regression checks. |
| website/README.md | Documents security validation and the remaining upstream advisory. |
| website/package.json | Adds KaTeX directly and updates security overrides. |
| website/package-lock.json | Locks patched dependencies and consolidates overridden packages. |
| website/docusaurus.config.js | Replaces CDN KaTeX CSS with the installed package’s stylesheet. |
Review effort: Balanced
|
Current-head validation update (80bde77): npm ci, npm ls --all, and all 41 website tests passed. The complete production build passed and generated 1,988 HTML pages; rendered math, bundled KaTeX CSS, and WOFF2 fonts were verified. The cross-major compatibility checks cover the Docusaurus CSS preset and real Tinypool worker execution. All 23 authenticated Dependabot alerts were reconciled against the new lockfile: 22 are addressed; alert 207 (braces, GHSA-vfj7-8cjw-p6xm) remains because no patched release exists. Azure build 242350922 is running against refs/pull/2788/merge. No environment.yml or CI workflow changes. |
|
Final validation for 80bde77: Azure build 242350922 passed all 59 jobs. Published results are 3,738 passed and 22 skipped; every skipped test identity/outcome matches the successful exact-base build. Notebook E2E was explicitly excluded by the existing website-only impact rules. All 41 website tests, the local 1,988-page production build, and the GitHub website build passed. The exact-head Copilot review has no open or suppressed findings, and the final readiness snapshot has no failed, pending, or missing checks. The branch is current with master; merge provenance and check issuers were verified. As agreed, braces@3.0.3 remains unchanged and its advisory remains visible. All other requested minimums are met. Engineering validation is complete for this scope; required human approval remains. |
acd6a8c
into
microsoft:master
The website dependency graph includes packages with command-injection, credential-leak, and denial-of-service advisories. This PR upgrades 11 affected packages, addressing 22 of the 23 open Dependabot alerts, without changing Docusaurus or the Python/Spark environment.
Agreed residual risk: retain
braces@3.0.3, which has no published fix for GHSA-vfj7-8cjw-p6xm. The requested scope explicitly accepts leaving it unchanged. This PR does not suppress that alert or claim a clean audit.Related Issues/PRs
Dependency graph. No linked issue is closed by this PR.
What changes are proposed in this pull request?
bracesadvisory.environment.yml, JVM dependencies, and CI workflows are unchanged.How is this patch tested?
Commands run from
websiteunless noted:npm ci --ignore-scripts --no-fund --no-auditandnpm test: passed, 37 tests.node --test test/dependencySecurity.test.js: shell-quote and KaTeX assertions failed as expected on the original dependencies; CSS compatibility passed.npm ci --no-audit --no-fund: passed with the updated lockfile.npm test: passed, 41 tests, zero skips. Includes direct worker-thread execution using the Docusaurus worker-data contract.npm ls --all --json: passed; no invalid or unmet dependencies.npm audit --json: initially 56 affected dependency nodes (17 critical, 20 high, 15 moderate, 4 low). After updates, only GHSA-vfj7-8cjw-p6xm remains, propagated through 29 high-severity dependency nodes; exit status remains nonzero.git diff --checkfrom the repository root: passed.WebsiteChannel.npm run build: passed, 1,988 generated HTML pages. Rendered math, bundled KaTeX CSS, and bundled WOFF2 fonts are present. The initial Windows run failed on three generated MDX pages; each parses successfully with LF instead of CRLF line endings. Only untracked generated docs were normalized to match Linux CI.refs/pull/2788/merge,reason=pullRequest. Published results: 3,738 passed, 22 skipped, zero failures/incomplete tests across 377 completed test runs. All 22 skipped test identities and outcomes match the successful exact-base build 242290625.80bde771c1327a6de40d6872a053d49760725145. Website deployment itself is correctly skipped for a PR.Get-PrReadiness.ps1 -PullRequest 2788 -WaitForReview -TimeoutMinutes 5: passed; automated review covers the head and no unresolved/suppressed findings remain.Get-PrReadiness.ps1 -PullRequest 2788 -RunPipeline -ExpectedHeadSha 80bde771c1327a6de40d6872a053d49760725145 -ExpectedBaseSha 71346cf992d489007d133a1a9f83c325e7694373: passed; evidence complete and remote engineering gates clear, zero failed/pending/missing checks. The current script requires review-wait and pipeline switches in separate invocations.Final integration/provenance: head
80bde771c1327a6de40d6872a053d49760725145is one commit ahead and zero behind currentmaster71346cf992d489007d133a1a9f83c325e7694373. Azure tested merge367bbe650b1c4818a9af5a6e77d6b1b309818b6f, whose parents are exactly those base/head SHAs. Required check issuers are Azure Pipelines and GitHub Actions. Engineering validation is complete for the agreed scope; human approval is still required.Scala/Python compilation, codegen, and port-runtime replay are not applicable to this website-only change. The complete authenticated Dependabot export contains 23 open alerts, all in
website/package-lock.json. Every installed version in the updated lockfile was compared with those affected ranges: 22 alerts are addressed, and only alert 207 (braces) remains.Does this PR change any dependencies?
braces@3.0.3is intentionally listed as unresolved, not fixed or waived. Replacing its glob-parser API or maintaining a private fork is not a safe drop-in dependency update.Does this PR add a new feature? If so, have you added samples on website?
website/docs/documentationfolder.Make sure you choose the correct class
estimators/transformersand namespace.DocTablepoints to correct API link.npm startto make sure the website renders correctly.<!--pytest-codeblocks:cont-->before each python code blocks to enable auto-tests for python samples.WebsiteSamplesTestsjob pass in the pipeline.