[CVE-2022-24999] impact on 2.x and 1.x

[ananzh]

Description

https://access.redhat.com/security/cve/cve-2022-24999

This still affects 2.x and 1.x

[ananzh]

=> Found "qs@6.11.0"
info Has been hoisted to "qs"
info Reasons this module exists
   - "workspace-aggregator-fcd13c05-7ace-4db5-8723-a423437734e1" depends on it
   - Hoisted from "_project_#supertest#superagent#qs"
   - Hoisted from "_project_#supertest#superagent#formidable#qs"
info Disk size without dependencies: "204KB"
info Disk size with unique dependencies: "256KB"
info Disk size with transitive dependencies: "768KB"
info Number of shared dependencies: 7
=> Found "request#qs@6.5.3"
info This module exists because "_project_#@osd#optimizer#node-sass#request" depends on it.
info Disk size without dependencies: "176KB"
info Disk size with unique dependencies: "176KB"
info Disk size with transitive dependencies: "176KB"
info Number of shared dependencies: 0
Done in 1.05s.

From above, we can see that qs is request node-sass and supertest.

• For supertest, 2.x is patched via #3220.
• For node-sass, it depends on qs@6.5.3. node-sass is deprecated and only upgraded in main. We replaced node-sass to dart-sass via #2054. Since it is a breaking change, we can't backport it to 2.x. Therefore, the only option is to resolve qs.

[joshuarrrr]

@ananzh Can this be closed? It looks like both backports have been merged.

[ananzh]

close it. Thanks josh