fix(security): bump stream-json 1.7.5 → 3.5.0 (backport 2.0 #33008)

[harsh-vador]

Backport of #33008 to 2.0 — stream-json part only.

Applied: stream-json 1.7.5 → 3.5.0 via root resolutions (GHSA-528h-pc64-c93x, O(depth²) DoS). Verified on this branch: yarn install clean, quicktype -s schema codegen works (the only quicktype mode this repo uses).

Not applicable on 2.0: the other #33008 bumps target deps that don't exist on this branch — tooling/antd-codemods (js-yaml) is absent, and ui-core-components has no vitest/svgo.

🤖 Generated with Claude Code

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[github-actions]

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

[github-actions]

✅ Playwright Results — workflow succeeded

Validated commit a8ba623fdc21a04455a1b9f1798a3be591ba8300 in Playwright run 34318683774, attempt 1.

✅ 557 passed · ❌ 0 failed · 🟡 0 flaky · ⏭️ 0 skipped · 🧰 0 lifecycle flaky

Performance

Blocking targets: ✅ met · Optimization targets: 🟡 in progress

Shard-job maxima below are not the full workflow wall time; the linked run includes build, fixture, planning, and reporting.

🕒 Full workflow signal wall (to summary) 57m 36s

⏱️ Max setup 2m 53s · max shard execution 17m 39s · max shard-job elapsed before upload 20m 48s · reporting 3s

🌐 205.27 requests/attempt · 2.82 app boots/UI scenario · 9.92% common-shard skew

Optimization targets still in progress:

• Browser traffic was 205.27 requests per attempt (convergence target: fewer than 200).
• Application boot ratio was 2.82 per UI scenario (1629 boots / 578 scenarios; convergence target: at most 1).

Shard	Passed	Failed	Flaky	Skipped	Lifecycle failed	Lifecycle flaky
✅ Shard chromium-01	133	0	0	0	0	0
✅ Shard chromium-02	140	0	0	0	0	0
✅ Shard chromium-03	126	0	0	0	0	0
✅ Shard data-asset-rules-01	65	0	0	0	0	0
✅ Shard domain-isolation-01	16	0	0	0	0	0
✅ Shard global-state-01	34	0	0	0	0	0
✅ Shard ingestion-01	1	0	0	0	0	0
✅ Shard reindex-01	2	0	0	0	0	0
✅ Shard search-01	11	0	0	0	0	0
✅ Shard search-rbac-01	29	0	0	0	0	0

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[gitar-bot]

Code Review ✅ Approved 1 resolved / 1 findings

Bumps stream-json from 1.7.5 to 3.5.0 via forced resolution to address a DoS vulnerability (GHSA-528h-pc64-c93x). The resolution override bypasses the pinned range constraint, and yarn install and quicktype codegen have been verified to work correctly. No issues found.

✅ 1 resolved

✅ Quality: Forced resolution jumps stream-json two majors past pinned range

📄 package.json:19
The resolutions override forces stream-json@3.5.0 onto quicktype@20.0.27, which depends on stream-json pinned exactly to 1.7.5 (yarn.lock:437). stream-json had breaking API changes across the 1.x→2.x→3.x majors, and resolutions bypass semver compatibility checks entirely, so quicktype could break at codegen time. Impact is limited to build-time type generation (quicktype -s schema in json2ts.sh) rather than production runtime, and the author reports verifying codegen still works; the residual risk is that a future quicktype bump could silently regress against this pinned override. Consider adding a comment noting why the override is safe, or re-verify codegen whenever quicktype is upgraded.

Options

Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}