Security issue in dependencies (koa)

[vadimka123]

Describe the bug

GHSA-593f-38f6-jp5m

Please update to 2.15.4 version of koa

Reproduction

https://github.com/module-federation/core/blob/main/packages/dts-plugin/package.json#L63

Used Package Manager

npm

System Info

-

Validations

• Read the docs.
• Read the common issues list.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Module federation issue and not a framework-specific issue.
• The provided reproduction is a minimal reproducible example of the bug.

[dotboris]

I'm noticing that the version of koa is pinned in package.json:

core/packages/dts-plugin/package.json

Line 63 in e602d82

"koa": "2.15.3",

I'm not sure why koa is pinned but I think that it might be worth switching it to a version range (ex ^2.15.4). This will allow users of this library to update koa without having to open an issue here.

[m23leung]

Hey folks. Any idea when this issue will be resolved? Currently flagged as a Critical security vulnerability for us. Thanks

[m23leung]

Someone can help merge this PR

#3514

[vadimka123]

@KyrieLii , @danpeen , can you please look?

this PR will fix issue - #3514