In dependency scan, nested dependency handlebars is vulnerable issue occurs due to lower version

[deepiga-obs]

Do you want to request a feature or report a bug?
Report a bug

What is the current behavior?
In Azure pipelines, perform security scan is failed due to nested dependency handlebars

If the current behavior is a bug, please provide the steps to reproduce.
While doing dependency scan in deployment pipelines or run the following command in local environment
docker run --rm -e "WORKSPACE=%cd%" -v %cd%:/app shiftleft/sast-scan scan --build
the issue occurs as shown below

My tsconfig.json

{
  "compilerOptions": {
    "module": "commonjs",
    "declaration": true,
    "removeComments": true,
    "emitDecoratorMetadata": true,
    "experimentalDecorators": true,
    "allowSyntheticDefaultImports": true,
    "target": "es2017",
    "sourceMap": true,
    "outDir": "./dist",
    "baseUrl": "./",
    "incremental": true,
    "moduleResolution": "Node",
    "esModuleInterop": true
  }
}

What is the expected behavior?
The dependency scan should pass.

What are the versions of Node.js, Mongoose and MongoDB you are using? Note that "latest" is not a version.
Nest Js: v7.6.15
Typescript: v4.2.3
Mongoose: v5.12.3

Workaround
Update the dependency Handlebars js to 4.0.14 or later

[vkarpov15]

Mongoose doesn't have handlebars as a dependency, directly or indirectly:

$ npm list handlebars
mongoose@5.12.4 /home/val/Workspace/MongoDB/mongoose
└── (empty)

[deepiga-obs]

@vkarpov15 Steps to reproduce,

1. Create a new empty node js project
2. install mongoose package
3. Check node_modules folder, it contains sift package. Inside the sift package we can found yarn lock file with handlebars@^4.0.1

[vkarpov15]

Oh ok, so this issue only happens if you use yarn. We'll reopen and see if we can repro and fix.