Skip to content

Conversation

@Dilli-Babu-Godari
Copy link
Contributor

@Dilli-Babu-Godari Dilli-Babu-Godari commented Jan 29, 2026

Description

Bumps lodash-es from 4.17.21 to 4.17.23. GHSA-xxjr-mmjv-4gpg

Motivation and Context

Impact

Test Plan

Contributor checklist

  • Please make sure your submission complies with our contributing guide, in particular code style and commit standards.
  • PR description addresses the issue accurately and concisely. If the change is non-trivial, a GitHub Issue is referenced.
  • Documented new properties (with its default value), SQL syntax, functions, or other functionality.
  • If release notes are required, they follow the release notes guidelines.
  • Adequate tests were added if applicable.
  • CI passed.
  • If adding new dependencies, verified they have an OpenSSF Scorecard score of 5.0 or higher (or obtained explicit TSC approval for lower scores).

Release Notes

Please follow release notes guidelines and fill in the release notes below.

== RELEASE NOTES ==

Security Changes
* Upgrade lodash-es from 4.17.21 to 4.17.23 to address `CVE-2025-13465 <https://github.com/advisories/GHSA-xxjr-mmjv-4gpg>`_.

@Dilli-Babu-Godari Dilli-Babu-Godari requested review from a team and yhwang as code owners January 29, 2026 06:21
@prestodb-ci prestodb-ci added the from:IBM PR from IBM label Jan 29, 2026
@prestodb-ci prestodb-ci requested review from a team and removed request for a team January 29, 2026 06:21
@linux-foundation-easycla
Copy link

linux-foundation-easycla bot commented Jan 29, 2026

CLA Signed

The committers listed above are authorized under a signed CLA.

  • ✅ login: Dilli-Babu-Godari / name: Dilli-Babu-Godari (9080db4)

@sourcery-ai
Copy link
Contributor

sourcery-ai bot commented Jan 29, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the frontend dependency lodash-es from version 4.17.21 to 4.17.23 in presto-ui to address a security advisory, by adjusting the locked version in yarn.lock.

File-Level Changes

Change Details Files
Upgrade lodash-es dependency to 4.17.23 in the presto-ui project to remediate a security vulnerability.
  • Update the locked lodash-es version from 4.17.21 to 4.17.23 in the Yarn lockfile
  • Ensure all transitive references to lodash-es in the lockfile now resolve to 4.17.23
presto-ui/src/yarn.lock

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've reviewed your changes and they look great!


Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

@Dilli-Babu-Godari Dilli-Babu-Godari force-pushed the cvefix_lodash_es branch 4 times, most recently from 84fdbed to e8c17ce Compare January 29, 2026 06:36
@Dilli-Babu-Godari Dilli-Babu-Godari changed the title Bump lodash-es from 4.17.21 to 4.17.23 in /presto-ui/src build(deps): Bump lodash-es from 4.17.21 to 4.17.23 in /presto-ui/src Jan 29, 2026
@prestodb prestodb deleted a comment from prestodb-ci Jan 29, 2026
@prestodb-ci
Copy link
Contributor

@unidevel imported this issue as lakehouse/presto #27051

Copy link
Member

@imjalpreet imjalpreet left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -3934,9 +3934,9 @@ locate-path@^7.1.0:
p-locate "^6.0.0"

lodash-es@^4.17.21:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I think we should update the version here too

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for pointing this out. Updated.

@Dilli-Babu-Godari Dilli-Babu-Godari force-pushed the cvefix_lodash_es branch 4 times, most recently from 9f154c2 to f3606ac Compare January 30, 2026 07:02
yhwang
yhwang previously approved these changes Feb 4, 2026
Copy link
Member

@yhwang yhwang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/LGTM

@Dilli-Babu-Godari
Copy link
Contributor Author

@yhwang can we merge this PR ?

@nishithakbhaskaran
Copy link
Contributor

nishithakbhaskaran commented Feb 9, 2026

@Dilli-Babu-Godari Can you rebase your branch? The current CI failures has been addressed in the latest master.
Also please squash your commits as well.

@Dilli-Babu-Godari Dilli-Babu-Godari force-pushed the cvefix_lodash_es branch 2 times, most recently from af93a53 to 1991ae3 Compare February 9, 2026 15:05
@yhwang yhwang merged commit ae63dc2 into prestodb:master Feb 10, 2026
111 of 112 checks passed
@yhwang
Copy link
Member

yhwang commented Feb 10, 2026

Need to re-run the test to meet the merging criteria. Done! Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

from:IBM PR from IBM

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants