security: Fix NPM dependency vulnerabilities in frontend package #2312

ANAMASGARD · 2026-01-03T06:53:04Z

Description

This PR fixes all npm security vulnerabilities in the frontend package by running npm audit fix --force and updating transient dependency versions.

Fixes #2311

Solution

Applied npm audit fix which updated transient dependency versions in package-lock.json to their patched versions.

Changes

File: frontend/package-lock.json
Action: Updated dependency lock versions to resolve security vulnerabilities

ScreenShot

Testing

npm audit shows 0 vulnerabilities
npm install completes successfully
Application runs correctly with npm run dev

Checklist

Security vulnerabilities resolved
No breaking changes introduced
Application tested locally

- Run npm audit fix to resolve all security vulnerabilities - Updated transient dependency versions in package-lock.json - Reduced vulnerabilities from 6 (1 high, 2 moderate, 3 low) to 0 Fixes kubestellar#2311

kubestellar-prow · 2026-01-03T06:53:09Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign onkar717 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubestellar-prow · 2026-01-03T06:53:14Z

Hi @ANAMASGARD. Thanks for your PR.

I'm waiting for a kubestellar member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Copilot

Copilot wasn't able to review any files in this pull request.

Files not reviewed (1)

frontend/package-lock.json: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-03T06:56:07Z

frontend/package-lock.json

      "version": "7.26.10",
      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.26.10.tgz",
      "integrity": "sha512-vMqyb7XCDMPvJFFOaT9kxtiRh42GwlZEg1/uIgtZshS5a/8OaduUfCi7kynKgc3Tw/6Uo2D+db9qBttghhmxwQ==",
      "dev": true,


The removal of "peer": true from @babel/core changes its dependency classification. This package is typically a peer dependency for build tools. Removing this flag may cause it to be installed as a direct dependency, potentially leading to version conflicts or duplicate installations. Verify this change is intentional and necessary for the security fix.

Suggested change

"dev": true,

"dev": true,

"peer": true,

Copilot · 2026-01-03T06:56:08Z

frontend/package-lock.json

    "node_modules/@emotion/react": {
      "version": "11.14.0",
      "resolved": "https://registry.npmjs.org/@emotion/react/-/react-11.14.0.tgz",
      "integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",


Removing "peer": true from @emotion/react changes it from a peer dependency to a direct dependency. This is a production dependency that is typically expected to be provided by the consuming application as a peer dependency. This change could result in multiple versions of @emotion/react being installed, leading to React context issues and increased bundle size. This doesn't appear to be related to a security fix.

Suggested change

"integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",

"integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",

"peer": true,

Copilot · 2026-01-03T06:56:08Z

frontend/package-lock.json

    "node_modules/@emotion/styled": {
      "version": "11.14.0",
      "resolved": "https://registry.npmjs.org/@emotion/styled/-/styled-11.14.0.tgz",
      "integrity": "sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA==",


Removing "peer": true from @emotion/styled changes it from a peer dependency to a direct dependency. Like @emotion/react, this is a production dependency that should remain a peer dependency. This change could cause version conflicts and runtime issues with React emotion styling.

Suggested change

"integrity": "sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA==",

"integrity": "sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA==",

"peer": true,

Copilot · 2026-01-03T06:56:08Z

frontend/package-lock.json

      "version": "6.4.8",
      "resolved": "https://registry.npmjs.org/@mui/system/-/system-6.4.8.tgz",
      "integrity": "sha512-gV7iBHoqlsIenU2BP0wq14BefRoZcASZ/4LeyuQglayBl+DfLX5rEd3EYR3J409V2EZpR0NOM1LATAGlNk2cyA==",


Removing "peer": true from @mui/system changes its dependency classification. This package should remain a peer dependency as it's part of the Material-UI ecosystem and has peer dependencies on React and Emotion.

Copilot · 2026-01-03T06:56:08Z

frontend/package-lock.json

    "node_modules/react": {
      "version": "19.2.1",
      "resolved": "https://registry.npmjs.org/react/-/react-19.2.1.tgz",
      "integrity": "sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==",


Removing "peer": true from react is a critical error. React must be a peer dependency to ensure only one instance exists in the application. Multiple React instances will cause hooks errors, context issues, and break the application. This change is unrelated to security fixes and must be reverted.

Suggested change

"integrity": "sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==",

"integrity": "sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==",

"peer": true,

Copilot · 2026-01-03T06:56:09Z

frontend/package-lock.json

      "version": "6.4.8",
      "resolved": "https://registry.npmjs.org/@mui/material/-/material-6.4.8.tgz",
      "integrity": "sha512-5S9UTjKZZBd9GfbcYh/nYfD9cv6OXmj5Y7NgKYfk7JcSoshp8/pW5zP4wecRiroBSZX8wcrywSgogpVNO+5W0Q==",


Removing "peer": true from @mui/material is problematic. Material-UI is a production dependency with peer dependencies on React and Emotion. Changing this to a direct dependency could lead to multiple instances being installed, causing theming and styling issues.

Copilot · 2026-01-03T06:56:09Z

frontend/package-lock.json

      "version": "9.4.2",
      "resolved": "https://registry.npmjs.org/@react-three/fiber/-/fiber-9.4.2.tgz",
      "integrity": "sha512-H4B4+FDNHpvIb4FmphH4ubxOfX5bxmfOw0+3pkQwR9u9wFiyMS7wUDkNn0m4RqQuiLWeia9jfN1eBvtyAVGEog==",
      "license": "MIT",


Removing "peer": true from @react-three/fiber is incorrect. This package is a React renderer for Three.js and should be a peer dependency to ensure a single instance is used across the application. Multiple instances would cause context and rendering issues.

Suggested change

"license": "MIT",

"license": "MIT",

"peer": true,

Copilot · 2026-01-03T06:56:09Z

frontend/package-lock.json

    "node_modules/@tanstack/react-query": {
      "version": "5.69.0",
      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.69.0.tgz",
      "integrity": "sha512-Ift3IUNQqTcaFa1AiIQ7WCb/PPy8aexZdq9pZWLXhfLcLxH0+PZqJ2xFImxCpdDZrFRZhLJrh76geevS5xjRhA==",


Removing "peer": true from @tanstack/react-query changes it from a peer dependency to a direct dependency. This is a state management library that should typically remain a peer dependency to avoid multiple instances, which could cause data synchronization issues.

Suggested change

"integrity": "sha512-Ift3IUNQqTcaFa1AiIQ7WCb/PPy8aexZdq9pZWLXhfLcLxH0+PZqJ2xFImxCpdDZrFRZhLJrh76geevS5xjRhA==",

"integrity": "sha512-Ift3IUNQqTcaFa1AiIQ7WCb/PPy8aexZdq9pZWLXhfLcLxH0+PZqJ2xFImxCpdDZrFRZhLJrh76geevS5xjRhA==",

"peer": true,

Copilot · 2026-01-03T06:56:09Z

frontend/package-lock.json

      "version": "10.4.0",
      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.0.tgz",
      "integrity": "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ==",
      "dev": true,


Removing "peer": true from @testing-library/dom appears incorrect. Testing libraries are typically peer dependencies in the dev dependency graph. While this is a dev dependency, changing its classification could affect how it's resolved during testing.

Suggested change

"dev": true,

"dev": true,

"peer": true,

Copilot · 2026-01-03T06:56:10Z

frontend/package-lock.json

      "resolved": "https://registry.npmjs.org/three/-/three-0.159.0.tgz",
-      "integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA==",
-      "peer": true
+      "integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA=="


Removing "peer": true from three is problematic. Three.js is typically a peer dependency in the 3D rendering ecosystem to ensure a single version is used across all three.js-related packages. This could lead to version conflicts and rendering issues.

Suggested change

"integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA=="

"integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA==",

"peer": true

Arpit529Srivastava · 2026-01-03T14:07:43Z

@kunal-511 @btwshivam do we need this?

security: fix npm dependency vulnerabilities

681d9ef

- Run npm audit fix to resolve all security vulnerabilities - Updated transient dependency versions in package-lock.json - Reduced vulnerabilities from 6 (1 high, 2 moderate, 3 low) to 0 Fixes kubestellar#2311

Copilot AI review requested due to automatic review settings January 3, 2026 06:53

github-project-automation bot added this to KubeStellar UI Project Jan 3, 2026

github-project-automation bot moved this to In Progress in KubeStellar UI Project Jan 3, 2026

kubestellar-prow bot added needs-ok-to-test size/L labels Jan 3, 2026

github-actions bot added frontend and removed needs-ok-to-test size/L labels Jan 3, 2026

Copilot started reviewing on behalf of ANAMASGARD January 3, 2026 06:53 View session

kubestellar-prow bot added the size/L label Jan 3, 2026

Copilot AI reviewed Jan 3, 2026

View reviewed changes

	"integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",
	"integrity": "sha512-O000MLDBDdk/EohJPFUqvnp4qnHeYkVP5B0xEG0D/L7cOKP9kefu2DXn8dj74cQfsEzUqh+sr1RzFqiL1o+PpA==",
	"peer": true,

	"integrity": "sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA==",
	"integrity": "sha512-XxfOnXFffatap2IyCeJyNov3kiDQWoR08gPUQxvbL7fxKryGBKUZUkG6Hz48DZwVrJSVh9sJboyV1Ds4OW6SgA==",
	"peer": true,

	"integrity": "sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==",
	"integrity": "sha512-DGrYcCWK7tvYMnWh79yrPHt+vdx9tY+1gPZa7nJQtO/p8bLTDaHp4dzwEhQB7pZ4Xe3ok4XKuEPrVuc+wlpkmw==",
	"peer": true,

	"integrity": "sha512-Ift3IUNQqTcaFa1AiIQ7WCb/PPy8aexZdq9pZWLXhfLcLxH0+PZqJ2xFImxCpdDZrFRZhLJrh76geevS5xjRhA==",
	"integrity": "sha512-Ift3IUNQqTcaFa1AiIQ7WCb/PPy8aexZdq9pZWLXhfLcLxH0+PZqJ2xFImxCpdDZrFRZhLJrh76geevS5xjRhA==",
	"peer": true,

	"integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA=="
	"integrity": "sha512-eCmhlLGbBgucuo4VEA9IO3Qpc7dh8Bd4VKzr7WfW4+8hMcIfoAVi1ev0pJYN9PTTsCslbcKgBwr2wNZ1EvLInA==",
	"peer": true

security: Fix NPM dependency vulnerabilities in frontend package #2312

Are you sure you want to change the base?

security: Fix NPM dependency vulnerabilities in frontend package #2312

Conversation

ANAMASGARD commented Jan 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Solution

Changes

ScreenShot

Testing

Checklist

Uh oh!

kubestellar-prow bot commented Jan 3, 2026

Uh oh!

kubestellar-prow bot commented Jan 3, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 3, 2026

Choose a reason for hiding this comment

Uh oh!

Arpit529Srivastava commented Jan 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ANAMASGARD commented Jan 3, 2026 •

edited

Loading