-
-
Notifications
You must be signed in to change notification settings - Fork 301
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Vulnerability open for a few days: GHSA-gpv5-7x3g-ghjv #591
Comments
We're glad you find this project helpful. We'll try to address this issue ASAP. You can vist https://solothought.com to know recent features. Don't forget to star this repo. |
I would like to add, that this report breaks auditing tools, e.g. pnpm audit (which can not omit/skip GHSA reports). And the report itself is a bit confusing, as it is not clear if it really is a security issue or just a suggestion. Hence, the consequences of this GHSA are quite unbalanced. |
This seems to have been fixed in 9a880b8 but a new release has not been published for this yet |
Any update on this? |
Will this be updated anytime soon? |
@amitguptagwl your published advisory on your most recent security fix means fix is hard to adopt GHSA-gpv5-7x3g-ghjv |
Need an update for this! |
Would be awesome to release this - aws-sdk-v3 depends on this library and brings this vulnerability |
Would like to see a quick release for this, as the issue is currently blocking many of our CI pipelines. |
If you want to "hotfix"/"force" your
Lockfile part of the library that depends on
Lockfile part where
(note that the commitID is the latest commit ID in the main branch of this repo - check it yourself to be sure!) It's obviously not pretty, and manual lockfile edits are not a good idea in general, but it may be an acceptable temporary hotfix for your case. Looking forward to an actual release including the fix on the upstream package :) ! |
Hi @amitguptagwl. Could you please help us on that? |
I'm little confused here. Someone has raised a PR to update GitHub Advisory Database which is not in my control. But there is no open security issue that I know. What should I do to solve the issue? So you guys should not see any error in your build pipeline |
Now I've updated all the advisories with fixed version. Please check if this solve your issue. |
@amitguptagwl , as @WikiRik pointed here a fix was already merged so it's a matter of releasing a new version as far as I understand |
@aaleksandrov I have that too few mins ago. So I hope everything is shorted now. |
Thanks, now |
This should not have been a security advisory in the first place but a regular issue, because the actual vulnerability was already fixed in 4.2.4. |
Our issue is now resolved. Thanks! |
I'm closing this issue. But if anything left then please reopen or comment. |
All the details here: GHSA-gpv5-7x3g-ghjv
This was opened a few days ago, but it looks like it was already patched? Or is it a false positive?
Either way, a release can be done or the vulnerability discarded, but as it stands our pipelines are stopped right now unless we ignore this but I'd prefer not to ignore without getting feedback here.
The text was updated successfully, but these errors were encountered: