[TEZ-4436] [TEZ-UI] uses many vulnerable libraries

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: PJ Fanning
• Created: 19/Jul/22 16:19
• Updated: 19/Jul/22 19:03

Description

TEZ-4337 might help to start.

I created a fork of tez in github and enabled dependabot (using security tab). Dozens of issues were found with NPMs that have known vulnerabilities.

Examples:

• https://github.com/advisories/GHSA-jf85-cpcp-j695 (loadash)
• https://github.com/advisories/GHSA-765h-qjxv-5f44 (handlebars)
• https://github.com/advisories/GHSA-wc69-rhjr-hc9g (moment)
• https://github.com/advisories/GHSA-xvch-5gv4-984h (minimist)
• https://github.com/advisories/GHSA-34r7-q49f-h37c (uglify-js)
• many more

Issue Links

• relates to: TEZ-4337 [TEZ UI] Upgrade to Ember 3
• relates to: TEZ-4419 Upgrade node and yarn version and fix npm security issues in Tez UI module