dbeaver/pro#8175 removes tar and lodash CVEs (#4096)

Co-authored-by: mr-anton-t <42037741+mr-anton-t@users.noreply.github.com>

webapp/package.json

@@ -14,7 +14,9 @@
     "react-dom": "^19",
     "mobx": "^6",
     "mobx-react-lite": "^4",
-    "glob": "^13"
+    "glob": "^13",
+    "tar": ">=7.5.4",
+    "lodash": ">=4.17.23"
   },
   "scripts": {
     "test": "dbeaver-test",

webapp/packages/plugin-data-spreadsheet-new/src/DataGrid/Formatters/CellFormatters/DateTimeFormatter.tsx

@@ -16,6 +16,10 @@ import { DateTimeKind, useFormattingContext } from '../../FormattingContext.js';
 import { TableDataContext } from '../../TableDataContext.js';
 import type { ICellFormatterProps } from '../ICellFormatterProps.js';
 
+function isValidDate(date: Date): boolean {
+  return !isNaN(date.getTime());
+}
+
 export const DateTimeFormatter = observer<ICellFormatterProps>(function DateTimeFormatter() {
   const tableDataContext = useContext(TableDataContext);
   const formattingContext = useFormattingContext();
@@ -34,12 +38,13 @@ export const DateTimeFormatter = observer<ICellFormatterProps>(function DateTime
     return <GridNullFormatter />;
   }
 
-  let value = displayValue;
+  let date = new Date(displayValue);
+  let dateFormatter: Intl.DateTimeFormat | null = null;
 
   if (formattingContext.formatters) {
     const extendedDateKind = formattingContext.getExtendedDateKind(cellContext.cell.column);
 
-    let dateFormatter: Intl.DateTimeFormat | null = null;
+
     switch (extendedDateKind) {
       case DateTimeKind.DateTime:
         dateFormatter = formattingContext.formatters.dateTime;
@@ -51,19 +56,22 @@ export const DateTimeFormatter = observer<ICellFormatterProps>(function DateTime
         dateFormatter = formattingContext.formatters.dateOnly;
         break;
     }
-    if (dateFormatter) {
-      if (DateTimeKind.TimeOnly === extendedDateKind) {
-        const [h = 0, m = 0, s = 0] = displayValue.split(':').map(Number);
-        const date = new Date();
-        date.setHours(h, m, s, 0);
-        value = dateFormatter.format(date);
-      } else {
-        const date = new Date(displayValue);
-        value = dateFormatter.format(date);
-      }
+
+    if (DateTimeKind.TimeOnly === extendedDateKind) {
+      const [h = 0, m = 0, s = 0] = displayValue.split(':').map(Number);
+      const time = new Date();
+      time.setHours(h, m, s, 0);
+
+      date = time;
     }
   }
 
+  let value = displayValue;
+
+  if (dateFormatter && isValidDate(date)) {
+    value = dateFormatter.format(date);
+  }
+
   return (
     <div className="tw:flex tw:items-center tw:overflow-hidden">
       <div className="tw:overflow-hidden tw:text-ellipsis">{value}</div>

webapp/yarn.lock

@@ -14572,10 +14572,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash@npm:^4.17.20, lodash@npm:^4.17.21, lodash@npm:~4.17.0":
-  version: 4.17.21
-  resolution: "lodash@npm:4.17.21"
-  checksum: 10c0/d8cbea072bb08655bb4c989da418994b073a608dffa608b09ac04b43a791b12aeae7cd7ad919aa4c925f33b48490b5cfe6c1f71d827956071dae2e7bb3a6b74c
+"lodash@npm:>=4.17.23":
+  version: 4.17.23
+  resolution: "lodash@npm:4.17.23"
+  checksum: 10c0/1264a90469f5bb95d4739c43eb6277d15b6d9e186df4ac68c3620443160fc669e2f14c11e7d8b2ccf078b81d06147c01a8ccced9aab9f9f63d50dcf8cace6bf6
   languageName: node
   linkType: hard
 
@@ -18552,16 +18552,16 @@ __metadata:
   languageName: node
   linkType: hard
 
-"tar@npm:^7.5.2":
-  version: 7.5.3
-  resolution: "tar@npm:7.5.3"
+"tar@npm:>=7.5.4":
+  version: 7.5.7
+  resolution: "tar@npm:7.5.7"
   dependencies:
     "@isaacs/fs-minipass": "npm:^4.0.0"
     chownr: "npm:^3.0.0"
     minipass: "npm:^7.1.2"
     minizlib: "npm:^3.1.0"
     yallist: "npm:^5.0.0"
-  checksum: 10c0/e5e3237bca325fbb33282d92d9807f4c8d81abaf71bf2627efdf93bd5610c146460c78fc7e9767d4ab5ae3c0b18af8197314c964f8cbd23b30b25bf4d42d7cb4
+  checksum: 10c0/51f261afc437e1112c3e7919478d6176ea83f7f7727864d8c2cce10f0b03a631d1911644a567348c3063c45abdae39718ba97abb073d22aa3538b9a53ae1e31c
   languageName: node
   linkType: hard