fix(ui): TE-2655 upgrade axios, swagger-ui-react and harden Docker to fix critical Snyk CVEs

[anshul98ks123]

Issue(s)

Address critical and high-severity Snyk vulnerabilities in the ThirdEye frontend and UI Docker image.

Fix 5+ Snyk security vulnerabilities by upgrading npm dependencies and hardening the UI container image:

CVE	Package	CVSS	Vulnerability
CWE-918	axios	6.2	Server-side Request Forgery (SSRF)
CWE-770	axios	6.9	Allocation of Resources Without Limits or Throttling
—	dompurify (via swagger-ui-react)	5.3	Template Injection (CWE-1336)
—	dompurify (via swagger-ui-react)	6.2	Cross-site Scripting (CWE-79)
—	dompurify (via swagger-ui-react)	8.3	Prototype Pollution (CWE-1321)
CVE-2025-49796	libxml2	9.1	Out-of-bounds Read
CVE-2025-49794	libxml2	9.1	Expired Pointer Dereference

The axios SSRF and resource allocation issues are fixed by upgrading to ^1.14.0. The dompurify vulnerabilities (template injection, XSS, prototype pollution) are resolved by upgrading swagger-ui-react to ^5.19.0 which pulls dompurify 3.1.x+. The libxml2 CVEs are resolved by adding apk upgrade to the UI Dockerfile.

---

Description

Frontend dependency upgrades and Docker hardening across 4 files in thirdeye-ui/. This is the minimum-scope set of changes needed to resolve all reported critical/high frontend Snyk findings.

---

What Changed

#	Area	Change
1	axios	^1.7.4 → ^1.14.0. Fixes SSRF (CWE-918) and resource allocation (CWE-770) issues.
2	swagger-ui-react	^5.10.5 → ^5.19.0. Fixes dompurify 3.0.6 template injection, XSS, and prototype pollution. Added overrides: { "react-redux": "8.1.3" } to maintain React 16 compatibility (swagger-ui-react >=5.12 pulls react-redux@9 which requires React 18's useSyncExternalStore).
3	Docker: UI image	Added RUN apk update && apk upgrade --no-cache libxml2 libxslt to thirdeye-ui/Dockerfile (nginx:1.27-alpine base). Fixes CVE-2025-49796, CVE-2025-49794.
4	e2e docker-compose	Updated Pinot image from 1.2.0 to 1.4.0 to match backend client version upgrade.

Version Changes

Dependency	Before	After	Notes
axios (npm)	^1.7.4	^1.14.0	Fixes CWE-918, CWE-770
swagger-ui-react (npm)	^5.10.5	^5.19.0	Fixes dompurify vulns
react-redux (override)	—	8.1.3	React 16 compat pin
Pinot Docker (e2e)	1.2.0	1.4.0	Match backend client version

---

Risk: react-redux Override

The overrides block in package.json pins react-redux to 8.1.3 because swagger-ui-react >= 5.12 transitively pulls react-redux@9 which uses React 18's useSyncExternalStore hook — unavailable in ThirdEye's React 16 runtime. This override is safe as long as ThirdEye remains on React 16. When React is eventually upgraded to 18+, the override should be removed.

---

Test Plan

• npm install --legacy-peer-deps — succeeds
• npm run build — webpack production build succeeds
• npm test — all 127 suites, 948 unit tests pass
• Manual verification of Swagger UI page
• Re-run Snyk scan on rebuilt UI Docker image to confirm libxml2 CVE resolution

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
thirdeye	Ready	Preview, Comment	Apr 16, 2026 0:19am