Security vulnerability in json-ptr

[samtstern]

I am a maintainer of the firebase-tools package and we depend on exegesis. Our npm audit shows the following:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary JavaScript Execution                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ json-ptr                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ exegesis                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ exegesis > json-ptr                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1706                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

According to json-ptr this was fixed in version 2.1.0 or higher. The good news is that this package has already done the harder upgrade to migrate to json-ptr 1.3.1 (which had an improperly SemVer-ed major change):
#146

So getting to 2.1.0+ shouldn't be too bad.

[samtstern]

Ah it looks like dependabot is already on it:
#260

[jwalton]

Thanks for the heads up. I'll fix it now! :)

[jwalton]

🎉 This issue has been resolved in version 2.5.7 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[samtstern]

@jwalton amazingly fast, thank you!