Skip to content

Commit

Permalink
[SPARK-50501][BUILD] Update cross-spawn to surpress a warning in lint
Browse files Browse the repository at this point in the history
### What changes were proposed in this pull request?
This PR updates cross-spawn from 7.0.3 to 7.0.6.

### Why are the changes needed?
Recently, `./dev/lint-js` shows a warning like as follows.
```
1 high severity vulnerability

To address all issues, run:
  npm audit fix

Run `npm audit` for details.
```

We can see the same message in CI.
https://github.com/apache/spark/actions/runs/12183892848/job/33986553884#step:24:20

To inspect more, I executed `npm audit` and the result is:
```
cross-spawn  7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - GHSA-3xgq-45jj-v275
fix available via `npm audit fix`
node_modules/cross-spawn

1 high severity vulnerability
```

`cross-spawn` is a dependency for the linter but the linter reports the issue as `high severity vulnerability` so let's fix it just in case.
This change is done by `npm audit fix` as the warning indicates.

### Does this PR introduce _any_ user-facing change?
No

### How was this patch tested?
`./dev/lint-js` doesn't show the warning.

### Was this patch authored or co-authored using generative AI tooling?
No

Closes #49077 from sarutak/update-cross-spawn.

Authored-by: Kousuke Saruta <[email protected]>
Signed-off-by: Dongjoon Hyun <[email protected]>
  • Loading branch information
sarutak authored and dongjoon-hyun committed Dec 5, 2024
1 parent ee8db4e commit 6add9c8
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions dev/package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 6add9c8

Please sign in to comment.