Fix: jsrsasign package audit issue #62

betimer · 2024-01-22T04:33:18Z

Fix issue with:

# npm audit report

jsrsasign  <11.0.0
Severity: high
Marvin Attack of RSA and RSAOAEP decryption in jsrsasign - https://github.com/advisories/GHSA-rh63-9qcf-83gf
No fix available
node_modules/jsrsasign
  @apple/app-store-server-library  *
  Depends on vulnerable versions of jsrsasign
  node_modules/@apple/app-store-server-library

alexanderjordanbaker · 2024-01-22T23:33:23Z

package.json

@@ -1,6 +1,6 @@
 {
  "name": "@apple/app-store-server-library",
-  "version": "1.0.0",
+  "version": "1.0.1",


If you are going to bump the version, please also bump the version in the user agent string as well

@alexanderjordanbaker good spot. done.

fix jsrsasign audit issue

1c2edb1

alexanderjordanbaker reviewed Jan 22, 2024

View reviewed changes

betimer and others added 2 commits January 25, 2024 22:33

update user agent

a20217a

Merge branch 'main' into fix/npm-audit-jsrsasign-issue

fac7ffc

alexanderjordanbaker approved these changes Jan 25, 2024

View reviewed changes

alexanderjordanbaker merged commit 7e70212 into apple:main Jan 25, 2024
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: jsrsasign package audit issue #62

Fix: jsrsasign package audit issue #62

betimer commented Jan 22, 2024

alexanderjordanbaker Jan 22, 2024

betimer Jan 25, 2024

Fix: jsrsasign package audit issue #62

Fix: jsrsasign package audit issue #62

Conversation

betimer commented Jan 22, 2024

alexanderjordanbaker Jan 22, 2024

Choose a reason for hiding this comment

betimer Jan 25, 2024

Choose a reason for hiding this comment