Vulnerability in a sub-dependency (form-data) in @google-cloud/storage@7.16.0

[hartikainen-ville]

@google-cloud/storage@7.16.0 package includes a dependency form-data@2.5.3

The package is labeled as a vulnerability. See more information here: GHSA-fjxv-7rqg-78g4.
Could you make the necessary changes?

[amplicity]

Agreed. Important for us as well.

[JackHowa]

Agree. This would be awesome to update the version. Looks like another update was merged today too googleapis/nodejs-storage@288e81e

It looks like there's an action to trigger an actual release? cc @ddelgrosso1

googleapis/nodejs-storage#2589

[enzoferey]

Hello team! We have a Vanta test due in 3 days for this one, any chances we get an update? 🙏🏻

I have seen the patched version from retry-request requires Node.js v18, which is mentioned at googleapis/nodejs-storage#2621 but I can't find any estimate on when it will land. Thanks!

[JackHowa]

ah, I'm still seeing the vulnerability with the update today cc @ddelgrosso1:

├─┬ @google-cloud/storage@7.17.0
│ └─┬ retry-request@7.0.2
│   └─┬ @types/request@2.48.12
│     └── form-data@2.5.1

googleapis/nodejs-storage@7bcb04f

[JackHowa]

created a pr for this @ddelgrosso1 @enzoferey @amplicity @hartikainen-ville googleapis/nodejs-storage#2636

[planv]

It is still relevant for version 7.18.0.

The retry-request package has been deprecated since July 2024.

https://github.com/googleapis/retry-request

Do you think it would make sense to remove it to address the Critical vulnerability in the form-data package?

Thank you in advance!

[nizans]

Not optimal but until this gets fixed as a workaround we override the form-data package. Seems safe since its only being used as a type in:
https://github.com/DefinitelyTyped/DefinitelyTyped/blob/11df58f3a74552eb67e5bf4358b93cead324a9de/types/request/index.d.ts#L10

"overrides": {
  "@google-cloud/storage": {
    "retry-request": {
      "@types/request": {
        "form-data": "2.5.5"
      }
    }
  }
},