Multiple security vulnerabilities in dependencies

[nseba]

Hi,

We use yarn and yarn audit in our build pipeline and by upgrading to the latest typedoc version (0.14.2), we have more than 20 vulnerabilities reported in the dependencies of typedoc. I have attached a JSON output containing the details.

audit.json.txt

[aciccarello]

Thanks for sharing, We'll update our dependencies before the next release which should help fix some of these.

[nseba]

In the meantime I was able to circumvent this problem by adding this into my package.json:

"resolutions": {
    "typedoc/highlight.js/gear-lib/knox/debug": "^2.6.9",
    "typedoc/highlight.js/gear-lib/jshint/cli": "^1.0.0",
    "typedoc/highlight.js/gear-lib/less/clean-css": "^4.1.11",
    "typedoc/highlight.js/gear-lib/less/request": "^2.68.0",
    "typedoc/highlight.js/**/uglify-js": "^2.6.0",
    "typedoc/highlight.js/**/handlebars": "^4.0.0",
    "typedoc/highlight.js/**/mime": "^1.4.1",
    "**/minimatch": "^3.0.2",
    "**/micromatch/braces": "^2.3.1"
  }```

So far I didn't get any errors when running typedoc, but it solved the audit warning.

[AndrewCraswell]

Is the next release scheduled soon? Many teams have policies against using modules that have reported security vulnerabilities. This seems like a big deal to be open for nearly a month...

[aciccarello]

Sorry, I'm working on some changes that I'm hoping to get into the next release but I may make an interim release.

Most of the security vulnerabilities are things like minimatch so the security vulnerabilities aren't relevant in this use case but I recognize that those things are hard to sort out.