Update "async": Security vulnerability, prototype pollution

[klassm]

Hi there,

there is a security vulnerability in the old async version, which is currently in use (GHSA-fwr7-v2mv-hh25). Would id be possible to update async to the latest version? This is a jump however from 0.9.x to 3.x.

Thanks
Matthias

[huineng]

https://github.ibm.com/advisories/GHSA-fwr7-v2mv-hh25
high severity
Vulnerable versions: < 3.2.2
Patched version: 3.2.2
A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.

[jacovinus]

fix waiting to be merged at #409

[nopeless]

subscribed so I can update ejs when its merged

[GoetzGoerisch]

Fixed with #411!
@mde can we get a new release please?

[jaishirole]

We too are waiting for the release with fix of #411 to be available.

[raejoonee]

Can't wait to upgrade to new release version with the fix of #411

[VamseeInala]

Waiting for the fix of #411 to be released

[JackHowa]

Hopefully this will be released! #412 cc @mde

[shreya410]

Waiting for the async audit fix urgently, our production deployment is blocked because of this. Request to kindly expedite.

[alert-debug]

@shreya410 I share your sense of urgency, but I'm not sure that requesting that the work be expedited is what's needed here. Instead it's a good time to reflect on the fact that so many talented people are choosing to devote their time to produce this useful software and make it freely available to the world. It might be possible to expedite it if more people provided funding to support that development, though.

[shreya410]

Absolutely! I deeply appreciate everyone's contributions here. Apologies if this sounded ungrateful.

[mde]

Apologies for the delay on this. Pushed to NPM, v10.8.5.

Re. funding, the the suggestions are appreciated, but I have a hard time imagining how donations for a project like this would pay anything resembling a full-time developer's salary.

Again, apologies for the delay pushing this out. I'll do my best to be a little more on top of these arbitrary bumps that are required to satisfy automated security audits.

And a quick reminder, I will delete posts on threads that I consider needlessly belligerent.

[playground]

Same here,
Getting

async <2.6.4
Severity: high
Prototype Pollution in async - GHSA-fwr7-v2mv-hh25
fix available via npm audit fix --force
Will install prompt@0.1.7, which is a breaking change
node_modules/winston/node_modules/async
winston 0.4.0 - 3.0.0-rc6
Depends on vulnerable versions of async
node_modules/winston
prompt >=0.1.8
Depends on vulnerable versions of winston
node_modules/prompt

3 high severity vulnerabilities

[mde]

This has been fixed. You need to update Jake.