Security vulnerability in jed package - sonatype-2019-0115 for jquery version

[Ancient-Dragon]

Is this a feature request or a bug?

feature / security vulnerability

What is the current behavior?

Currently the project uses jed-1.1.1, this has a fairly high scoring vulnerability against it, and the project hasn't been worked on in years. Any chance we can rework this library to get around using jed?
Where the issue was reported: testng-team/testng#2150, (if you go into the test folder in the jed project you'll find the jquery-1.7.1 file.

What is the expected or desired behavior?

Same behavior just without using jed

[rpl]

jed isn't used directly in this repository, it is actually a dependency of the addons-linter.

jed last update seems to be happened 5 years ago, and so it is definitely not an actively maintained npm package, but the sonatype-2019-0115 doesn't seem relevant: the fact that jed does include an old jquery copy in its test assets does not imply that it does inherit jquery vulnerabilities.

In theory this issue may be reported on addons-linter, but if you decide to file it in the addons-linter repo then I would suggest to either:

• file it as a security issue if there is a security advisory that can be actually be affecting the dependents of the jed package (sonatype-2019-0115 does look that it would, I can imagine it was a valid security issue for primefaces, because in that case an old jquery copy was used outside of tests and actually exposing the security issue making it potentially exploitable, in this case jquery is part of the test suite and only used while running those tests, which neither web-ext or addons-linter do ever run)

• or file it as a "deprecated/unmaintained dependency" issue, suggesting to possibly replace it with an npm package that provide similar features but it is also actively maintained.

I'm closing this issue as invalid for the web-ext repo, as anticipated this project does not directly use jed and so it can't replace it neither.

[Rob--W]

FYI it's been filed as mozilla/addons-linter#3769