optimize: fix dependency security vulnerabilities - #8221
Open
slievrly wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The updated npm lockfiles introduce a transitive dependency (node-releases) that declares Node >=18 via its engines field, which should be explicitly reconciled with the project’s supported Node/runtime expectations to avoid install/build breakage.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR updates frontend (npm) and backend (Maven) dependencies to address known security vulnerabilities, and adjusts the console frontend build minification configuration to accommodate updated CSS tooling behavior.
Changes:
- Bump/override multiple npm transitive dependencies (e.g., js-yaml, nanoid, qs, uuid) in the Saga designer and Console frontend lockfiles.
- Update embedded Tomcat versions across Maven modules (9.0.118 → 9.0.121, 11.0.22 → 11.0.25).
- Configure CssMinimizerPlugin to disable rule-merging during production builds to avoid issues with updated selector parsing behavior.
File summaries
| File | Description |
|---|---|
| saga/seata-saga-statemachine-designer/package.json | Updates npm overrides to newer patched dependency versions (incl. js-yaml, uuid). |
| saga/seata-saga-statemachine-designer/package-lock.json | Regenerates lockfile to reflect upgraded transitive dependencies. |
| console/src/main/resources/static/console-fe/package.json | Updates npm overrides for patched versions (incl. nanoid, js-yaml, uuid). |
| console/src/main/resources/static/console-fe/package-lock.json | Regenerates lockfile to reflect upgraded transitive dependencies. |
| console/src/main/resources/static/console-fe/build/webpack.prod.conf.js | Adjusts CSS minification options to avoid problematic merge behavior after dependency updates. |
| dependencies/pom.xml | Bumps shared Tomcat embed version for web modules (9.0.121). |
| mock-server/pom.xml | Bumps Tomcat embed version to 9.0.121 in mock server module. |
| namingserver/pom.xml | Bumps Tomcat embed version to 11.0.25 in namingserver module. |
| console/pom.xml | Bumps Tomcat embed version to 11.0.25 in console module. |
Review details
Files not reviewed (2)
- console/src/main/resources/static/console-fe/package-lock.json: Generated file
- saga/seata-saga-statemachine-designer/package-lock.json: Generated file
Suppressed comments (1)
saga/seata-saga-statemachine-designer/package-lock.json:7456
- This lockfile update pulls in node-releases with an engines requirement of Node >=18. If any build/packaging workflow (or developers) still run npm install under Node 14/16, installs can fail when engine-strict is enabled (and may break at runtime if the dependency relies on newer Node features). Please confirm the supported Node version for this package and either (a) document/enforce it via package.json "engines", or (b) pin transitive deps to Node-<18-compatible versions.
- Files reviewed: 7/9 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+10111
to
+10113
| "engines": { | ||
| "node": ">=18" | ||
| } |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## 2.x #8221 +/- ##
============================================
+ Coverage 73.22% 73.37% +0.14%
Complexity 1146 1146
============================================
Files 1153 1153
Lines 42348 42348
Branches 5061 5061
============================================
+ Hits 31011 31074 +63
+ Misses 8852 8799 -53
+ Partials 2485 2475 -10 see 22 files with indirect coverage changes 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ⅰ. Describe what this PR did
fix dependency security vulnerabilities
Ⅱ. Does this pull request fix one issue?
Ⅲ. Why don't you add test cases (unit test/integration test)?
Ⅳ. Describe how to verify it
Ⅴ. Special notes for reviews