From a01b66b46127852fa178e033c21a738d7f732589 Mon Sep 17 00:00:00 2001 From: srv-rr-github-token <94607705+srv-rr-github-token@users.noreply.github.com> Date: Wed, 10 Jun 2026 20:48:43 +0000 Subject: [PATCH 1/2] chore(release): 6.5.1 ## [6.5.1](https://github.com/splunk/addonfactory-ucc-generator/compare/v6.5.0...v6.5.1) (2026-06-10) ### Bug Fixes * replace runtime JS cache busting with build-time timestamp ([#2053](https://github.com/splunk/addonfactory-ucc-generator/issues/2053)) ([d36af9c](https://github.com/splunk/addonfactory-ucc-generator/commit/d36af9c8b363dcc891f2b2baff39738aa33e9fdf)) --- NOTICE | 6 +++--- docs/CHANGELOG.md | 7 +++++++ pyproject.toml | 2 +- splunk_add_on_ucc_framework/__init__.py | 2 +- ui/package.json | 2 +- 5 files changed, 13 insertions(+), 6 deletions(-) diff --git a/NOTICE b/NOTICE index 1f370695b..eed9832a8 100644 --- a/NOTICE +++ b/NOTICE @@ -7,9 +7,9 @@ The following 3rd-party software packages may be used by or distributed with addonfactory-ucc-generator. Any information relevant to third-party vendors listed below are collected using common, reasonable means. -Date generated: 2026-6-5 +Date generated: 2026-6-10 -Revision ID: 51139f5785f979bdd9ba18b633a1f493e6bf2934 +Revision ID: fe3bd31bab25f40705190596327a9fbc6b8e031a ================================================================================ ================================================================================ @@ -86229,4 +86229,4 @@ Permission is granted to anyone to use this software for any purpose, including -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- -Report Generated by FOSSA on 2026-6-5 +Report Generated by FOSSA on 2026-6-10 diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 0122e8e49..5759cc599 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [6.5.1](https://github.com/splunk/addonfactory-ucc-generator/compare/v6.5.0...v6.5.1) (2026-06-10) + + +### Bug Fixes + +* replace runtime JS cache busting with build-time timestamp ([#2053](https://github.com/splunk/addonfactory-ucc-generator/issues/2053)) ([d36af9c](https://github.com/splunk/addonfactory-ucc-generator/commit/d36af9c8b363dcc891f2b2baff39738aa33e9fdf)) + # [6.5.0](https://github.com/splunk/addonfactory-ucc-generator/compare/v6.4.0...v6.5.0) (2026-06-05) diff --git a/pyproject.toml b/pyproject.toml index c95055285..45a63d58f 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -16,7 +16,7 @@ [tool.poetry] name = "splunk_add_on_ucc_framework" -version = "6.5.0" +version = "6.5.1" description = "Splunk Add-on SDK formerly UCC is a build and code generation framework" license = "Apache-2.0" authors = ["Splunk "] diff --git a/splunk_add_on_ucc_framework/__init__.py b/splunk_add_on_ucc_framework/__init__.py index 350241f89..f9397f14e 100644 --- a/splunk_add_on_ucc_framework/__init__.py +++ b/splunk_add_on_ucc_framework/__init__.py @@ -13,7 +13,7 @@ # See the License for the specific language governing permissions and # limitations under the License. # -__version__ = "6.5.0" +__version__ = "6.5.1" import logging diff --git a/ui/package.json b/ui/package.json index 1164f7b65..e05017312 100644 --- a/ui/package.json +++ b/ui/package.json @@ -6,7 +6,7 @@ "url": "git+https://github.com/splunk/addonfactory-ucc-generator.git", "directory": "ui" }, - "version": "6.5.0", + "version": "6.5.1", "license": "Apache-2.0", "author": "Splunk Inc.", "homepage": "https://splunk.github.io/addonfactory-ucc-generator", From d237b3304e23f3d0cbadcea9b5148840ab3d9d33 Mon Sep 17 00:00:00 2001 From: kkedziak-splunk Date: Fri, 19 Jun 2026 15:56:55 +0200 Subject: [PATCH 2/2] fix(security): upgrade transitive deps to resolve VULN-83884/83951/84021 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - @xmldom/xmldom 0.8.12 → 0.8.13 (CVE-2026-41673, HIGH: stack overflow DoS) - fast-uri 3.1.0 → 3.1.2 (CVE-2026-6321, HIGH: path normalization bypass) - brace-expansion 5.0.5 → 5.0.6 (CVE-2026-45149, MEDIUM: OOM before max limit) All three are transitive deps under ui/; fixed via yarn resolutions for fast-uri and @xmldom/xmldom. brace-expansion 5.x upgraded automatically within its existing ^5.0.2 range. Co-Authored-By: Claude --- ui/package.json | 4 +++- ui/yarn.lock | 34 +++++++++++++++++----------------- 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/ui/package.json b/ui/package.json index 5a0c004d5..ed2fa5a83 100644 --- a/ui/package.json +++ b/ui/package.json @@ -183,7 +183,9 @@ "crypto-js": "^4.2.0", "vitest/vite": "^7.3.1", "lodash": "^4.18.1", - "protocol-buffers-schema": "^3.6.1" + "protocol-buffers-schema": "^3.6.1", + "fast-uri": "^3.1.2", + "@xmldom/xmldom": "^0.8.13" }, "engines": { "node": "22.22.0", diff --git a/ui/yarn.lock b/ui/yarn.lock index b833bbe7a..0d875f6e1 100644 --- a/ui/yarn.lock +++ b/ui/yarn.lock @@ -4191,10 +4191,10 @@ resolved "https://registry.npmjs.org/@vue/shared/-/shared-3.5.31.tgz#83276e1d450fea7d20dd15c3bbafbea5aada122d" integrity sha512-nBxuiuS9Lj5bPkPbWogPUnjxxWpkRniX7e5UBQDWl6Fsf4roq9wwV+cR7ezQ4zXswNvPIlsdj1slcLB7XCsRAw== -"@xmldom/xmldom@^0.8.11": - version "0.8.12" - resolved "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz#cf488a5435fa06c7374ad1449c69cea0f823624b" - integrity sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg== +"@xmldom/xmldom@^0.8.11", "@xmldom/xmldom@^0.8.13": + version "0.8.13" + resolved "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz#00d1dd940b218dff2e49309d410d8bb212159225" + integrity sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw== ace-builds@^1.42.0: version "1.43.6" @@ -4763,24 +4763,24 @@ bourbon@^7.3.0: integrity sha512-u9ZUqmaX7K7nkarKODlFT4/XYfWafLRoadlv2Lye8hytrIA4Urg/50rav1eFdbdbO6o9GnK9a6qf7zwq808atA== brace-expansion@^1.1.7: - version "1.1.13" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz#d37875c01dc9eff988dd49d112a57cb67b54efe6" - integrity sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w== + version "1.1.15" + resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz#a6d90d54067236e5f42570a3b7378d594d9b7738" + integrity sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg== dependencies: balanced-match "^1.0.0" concat-map "0.0.1" brace-expansion@^2.0.1, brace-expansion@^2.0.2: - version "2.0.3" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz#0493338bdd58e319b1039c67cf7ee439892c01d9" - integrity sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA== + version "2.1.1" + resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz#c68b1c4111c76aae3a6fba55d496cee10c39dad8" + integrity sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA== dependencies: balanced-match "^1.0.0" brace-expansion@^5.0.2, brace-expansion@^5.0.5: - version "5.0.5" - resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz#dcc3a37116b79f3e1b46db994ced5d570e930fdb" - integrity sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ== + version "5.0.6" + resolved "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz#ec68fe0a641a29d8711579caf641d05bae1f2285" + integrity sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g== dependencies: balanced-match "^4.0.2" @@ -6705,10 +6705,10 @@ fast-png@^6.2.0: iobuffer "^5.3.2" pako "^2.1.0" -fast-uri@^3.0.1: - version "3.1.0" - resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz#66eecff6c764c0df9b762e62ca7edcfb53b4edfa" - integrity sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA== +fast-uri@^3.0.1, fast-uri@^3.1.2: + version "3.1.2" + resolved "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz#8af3d4fc9d3e71b11572cc2673b514a7d1a8c8ec" + integrity sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ== fastest-levenshtein@^1.0.16: version "1.0.16"