NMS-20181: Dependency updates for core/web-assets, August 2026

[synqotik]

Dependency Updates — Legacy UI (/core/web-assets), August 2026

Branch: jira/NMS-20181-dependabot-core-web-assets-august-2026 (based on release-36.x).
Source data: open Dependabot PRs targeting develop (Dependabot does not file PRs against release-36.x).
Package manager: pnpm 10.24.0. All updates verified with pnpm run webpack (dev), pnpm run webpack-release (production), and pnpm test (21 suites, 174 tests passing — includes 9 new IP-validation tests, see Section 3).

NOTE: We will need to address some of these issues in next major version or a minor version release, since they can only be fixed with major version dependency updates that require more significant code changes.

Section 1 — Dependabot Updates

Legacy UI (/core/web-assets) — Dependabot Updates

Library	From	To	Type	Notes
ts-jest	29.4.9	29.4.12	patch	PR #8759 (jest group)
@babel/core	7.29.0	7.29.7	patch	PR #8580 targeted 7.29.6; ^ semver resolved 7.29.7
ip-address	10.2.0	10.5.0	minor	PR #8738 targeted 10.3.1; ^ semver resolved 10.5.0. Behavior change: 10.5.0 rejects leading-zero IPv4 octets (010.1.1.1, 1.2.3.04) that 10.2.0 accepted. This is deliberate upstream hardening — leading zeros are ambiguous (octal to C parsers, decimal to Java) — but it changes released validation behavior in isValidIPAddress (used by newInterface.jsp, the discovery add pages, path outage pages, and requisition constraints). Java's InetAddress still accepts these as decimal, so the UI is now stricter than the backend. Pinned with explicit tests in ipaddress.test.js.
typescript	5.9.3	— (reverted)	major	PR #8475 targeted 6.0.3, which was applied and then reverted to ~5.9.3. Nothing in this package runs tsc (webpack transpiles via babel), so the compiler major bought no coverage, and @typescript-eslint 7.18.0 declares support for <5.6.0 — a compiler three majors ahead of the linter is risk without payoff on a release branch. TS 6 belongs on develop paired with a @typescript-eslint 8.x upgrade.
loader-utils	0.2.17	1.4.2	major (partial)	PR #8673 targeted 3.3.1. A tree-wide 3.3.1 override breaks babel-loader 8 (loaderUtils.getOptions was removed in v3). Applied scoped pnpm override "loader-utils@<1": "^1.4.2" instead — this moves all four packages that resolved the vulnerable 0.2.17 (string-replace-webpack-plugin@0.1.3 and the css-loader@0.9.1 / file-loader@0.8.5 / style-loader@0.8.3 it declares as deps) to 1.4.2; CVE-2022-37601/37603 are fixed as of 1.4.1/1.4.2. Remaining tree copies are patched 1.4.2/2.0.4. Declared entry stays ^2.0.4.
yargs	16.2.0	— (not applied)	major	PR #8760 targeted 18.1.0. yargs 18 is ESM-only; webpack.config.js loads it via CommonJS require('yargs') (SyntaxError: Cannot use import statement outside a module). Reverted; stays at 16.2.2. Applying would require reworking argv parsing in webpack.config.js.
cross-env	7.0.3	— (skipped)	major	PR #8474; already at 10.1.0 in package.json and lockfile
uglify-js	2.8.29	— (skipped)	major	PR #8473 (transient); already forced to 3.19.3 via existing pnpm override

Section 2 — OSV-Scanner Security Remediations

Scan before: 50 known vulnerabilities across 17 packages (2 Critical, 25 High). Scan after: 19 across 6 packages (1 Critical, 5 High, 13 Medium) — none remediable without breaking the webpack 4 toolchain. The biggest single win was removing phantomjs-prebuilt outright (see Section 3), which deleted the deprecated request subtree instead of patching around it.

Package	CVSS	From	To	Declared/Transient	Method	Status
tar	9.2 (highest of 13 advisories)	4.4.19	7.5.22	Transient (declared by cacache@15.3.0, though cacache never actually loads it — no require('tar') in its code, so this was lockfile hygiene rather than a live code path)	Bumped stale pnpm override "tar": "^4.4.13" → "^7.5.21" (the old override was actively forcing tar down to 4.x — the real find here)	Remediated
form-data	8.7	4.0.5	4.0.6	Transient (jsdom via jest-environment-jsdom)	pnpm override "form-data@>=4 <5": "^4.0.6"	Remediated
immutable	8.7	5.1.5	5.1.9	Transient (sass)	pnpm override "immutable": "^5.1.8"	Remediated
brace-expansion	7.7	1.1.14	1.1.18	Transient	Bumped existing override "brace-expansion@>=1 <2" → "^1.1.18"	Remediated
brace-expansion	7.7	2.1.0	2.1.4	Transient	Bumped existing override "brace-expansion@>=2 <3" → "^2.1.4"	Remediated
js-yaml	7.5	3.14.2	3.15.1	Transient	Bumped existing override "js-yaml" → "^3.15.1"	Remediated
loader-utils	7.5	0.2.17	1.4.2	Transient (string-replace-webpack-plugin + the css/file/style-loader versions it declares)	pnpm override "loader-utils@<1": "^1.4.2"	Remediated
ajv	5.6	4.11.8	6.14.0	Transient (parallel-webpack)	pnpm override "ajv@<5": "^6.14.0"	Remediated
request	6.1	2.88.2	— (removed)	Transient (phantomjs-prebuilt)	Deleted phantomjs-prebuilt (dead devDependency), which removed request and its entire subtree — including the previously-listed form-data@2.5.x and uuid@3.x rows, whose overrides are also gone	Remediated (removed)
@tootallnate/once	3.3	2.0.0	2.0.1	Transient (jsdom via http-proxy-agent)	pnpm override "@tootallnate/once": "^2.0.1" (advisory GHSA-vpq2-c234-7xj6 postdates the original scan)	Remediated
babel-traverse	9.3	6.26.0	—	Transient (babel 6 chain via babel-preset-es2015-nostrict)	—	Not fixed — no fixed version exists (babel 6 is EOL; fix line is @babel/traverse 7)
svgo	8.2	1.3.2	—	Transient (cssnano 4 → postcss-svgo)	—	Not fixed — fix is svgo 2.8.3, incompatible with cssnano 4 / webpack 4 CSS pipeline
angular	7.6 (highest of 10 advisories)	1.8.3	—	Declared	—	Not fixed — AngularJS is EOL, no fixed version released
postcss	7.5 (highest of 5 advisories)	7.0.39	—	Transient (postcss-loader 3, autoprefixer 9, cssnano 4)	—	Not fixed — fix requires postcss 8.x, incompatible with the webpack 4-era CSS toolchain
elliptic	5.6	6.6.1	—	Transient	—	Not fixed — no fixed version released
angular-sanitize	4.8	1.8.3	—	Declared	—	Not fixed — AngularJS is EOL, no fixed version released

Section 3 — Code-Review Follow-ups

Changes made in response to review feedback on this PR:

• Removed phantomjs-prebuilt — a dead devDependency (tests are jest + jsdom; no karma; no reference in src/, pom.xml, or webpack.config.js). This deleted 71 lockfile entries including the deprecated request@2.88.2 subtree, retired the unfixable request CVE row, and let ten pnpm overrides be pruned (atob, cryptiles, deep-extend, form-data@>=2 <3, fstream, growl, hoek, sshpk, stringstream, uuid@<4) — verified as a pure-removal lockfile diff with no resolution changes to anything that remains. It also moots a review finding that the uuid@<4 → ^11.1.1 override had left request un-loadable (require('uuid/v4') → ERR_PACKAGE_PATH_NOT_EXPORTED).
• Fixed checkIpRange for IPv6 (src/main/assets/js/vendor/ipaddress-js.js) — the IPv6 branch called compareTo() on a native BigInt (jsbn was dropped in ip-address 9), throwing TypeError and silently bypassing range validation in add-er.jsp/add-ir.jsp. Pre-existing bug, not introduced by this PR; now compares with >= like the IPv4 branch, with new tests covering IPv6 in-order/equal/inverted ranges, inverted IPv4, and mixed-family inputs.
• Reverted TypeScript to ~5.9.3 (see Section 1).
• Updated .node-version from 16.15.1 to 22.22.2, matching engines (>=22) and the Maven build's pinned v22.22.2, so local nvm/fnm users match CI.
• Added @tootallnate/once override (see Section 2).

A known caveat, also from review: several overrides use ^ ranges, so non-CI installs (pnpm install without --frozen-lockfile) can re-resolve past the exact versions tested here — this PR's own body records two such overshoots (@babel/core 7.29.6→7.29.7, ip-address 10.3.1→10.5.0). Left as-is for now; switching CVE-motivated overrides to exact pins is a possible follow-up.

External References

• Jira (Issue Tracker): https://opennms.atlassian.net/browse/NMS-20181

[marshallmassengill]

LGTM!

Minor findings for some future thing to look at. Would merge without any of these:

1. uuid@<4: ^11.1.1 leaves request non-loadable. request@2.88.2's lib/{auth,oauth,multipart}.js all do require('uuid/v4'); that subpath was removed in uuid 7 and uuid 11.1.1's exports map only declares . and ./package.json. Verified: ERR_PACKAGE_PATH_NOT_EXPORTED: Package subpath './v4' is not defined. request@2.88.2 is the override's only consumer, and phantomjs-prebuilt is request's only consumer, so nothing loads it today (there's no pnpm.onlyBuiltDependencies, so pnpm 10 runs no install scripts). Net: a CVE row traded for a latent module-resolution failure.
2. The real fix for that cluster is deleting phantomjs-prebuilt. It's a dead devDependency: no karma, tests are jest + jsdom, and nothing in src/, pom.xml, or webpack.config.js references it. Dropping it removes request and with it uuid@3, form-data@2, tough-cookie, sshpk, http-signature, hoek, stringstream, qs, extend, har-validator, lets you delete ~6 overrides, and retires the "request 6.1 / not fixed" row outright.
3. tar: ^7.5.21 is also inert. cacache@15.3.0 declares tar: ^6.0.2 but has zero require('tar') anywhere in its JS. Keep it (it undoes an override that was actively forcing tar down to 4.4.19, which is the real find here), but the body's "Transient (cacache via copy-webpack-plugin / terser-webpack-plugin)" implies a live code path that doesn't exist.
4. loader-utils scope claim is understated. Four packages resolved 0.2.17, not one: string-replace-webpack-plugin@0.1.3 plus the css-loader@0.9.1 / file-loader@0.8.5 / style-loader@0.8.3 it declares as deps. All four moved to 1.4.2. Outcome is still fine (see Cleared), but "the only vulnerable copy" isn't accurate.
5. ip-address 10.2.0 → 10.5.0 changes released validation behavior. Probed 24 inputs across both versions; exactly one delta: leading-zero IPv4 octets now throw. 010.1.1.1, 1.2.3.04, 01.02.03.04 flip from valid to invalid. That feeds isValidIPAddress in admin/newInterface.jsp, admin/discovery/add-{specific,er,ir}.jsp, buildPathOutage.jsp, setPathOutage.jsp, and requisition constraints. 10.2.0 shipped in opennms-36.0.2-1, so this is a change to released behavior and belongs in the description. It's hardening (ambiguous octal), but note Java's InetAddress reads 010.1.1.1 as decimal 10.1.1.1, so the UI now rejects what the backend accepts.
6. checkIpRange is broken for IPv6, and the test suite can't see it. Address6#bigInt() returns a native BigInt, so b.bigInt().compareTo(a.bigInt()) throws TypeError on both 10.2.0 and 10.5.0. Not a regression (predates this PR, back to the ip-address 9 move off jsbn), but add-er.jsp / add-ir.jsp range validation is dead for IPv6 and ipaddress.test.js only covers an IPv4 range, so "169 tests passing" doesn't touch it.
7. TypeScript 6.0 buys nothing on a release branch. No script runs tsc; webpack transpiles via babel and there's no ts-loader, so "build passes" doesn't exercise the compiler. Actual consumers are ts-jest (peer >=4.3 <7, fine) and @typescript-eslint 7.18.0, whose SUPPORTED_TYPESCRIPT_VERSIONS is >=4.7.4 <5.6.0 and which was already out of range at 5.9.3. So nothing newly breaks, but a compiler major on release-36.x with a linter three majors behind is risk without payoff; the change that would actually help is @typescript-eslint 8.x on develop.
8. .node-version still says 16.15.1 while engines says >=22 and tar@7 requires >=18. Maven pins nodeVersion v22.22.2 so CI is unaffected; local nvm/fnm users land on a Node the tree no longer supports. Cheap drive-by fix.
9. ^ ranges on CVE pins drift. The body itself records two overshoots (@babel/core 7.29.6→7.29.7, ip-address 10.3.1→10.5.0), and install-deps is pnpm install --prefer-offline with no--frozen-lockfile, so a non-CI build can silently re-resolve past what was tested.

[synqotik]

@marshallmassengill thanks, some of these seem valid, going to do another pass.

[synqotik]

@marshallmassengill fixed the relevant issues you raised

[marshallmassengill]

Changes look good.

[mershad-manesh]

I think the changes looks good;

Given that we are now being strict when it comes with IP Addresses (for example we reject ones starting with 0), should we add a warning in the breaking changes on our Docs?