'uri-js' version <=2.1.1 has security issue.

[SiddharthMishraPersonal]

We found through https://nodesecurity.io/advisories/100 website that 'uri-js' version used by 'json-refs' has vulnerability issue.
We have to update 'uri-js' version to it's latest i.e. 3.0.2

Please suggest how to do it?

[whitlockjc]

I'll be updating all dependencies during the next release, which should be within the next day or so. I've already updated path-loader for a similar issue and json-refs, sway and swagger-tools will be updated as soon as json-refs is released.

[SiddharthMishraPersonal]

Great @whitlockjc
Thanks for quick response. I will be waiting for the next release.

[rcarroll380]

@whitlockjc not sure how it all works, but do you plan on releasing 2.1.7 for this update?

[whitlockjc]

I'm planning on releasing a 3.0.0 that fixes this. I could potentially release a 2.1.17 with these changes as well if need be but the new resolver is way better and upgrading should be done for accuracy and efficiency.

[whitlockjc]

I'll be releasing 3.0.0 hopefully sometime today. I'll consider a 2.1.x release as well.

[akeating]

Awesome, I use swagger-tools and an update to 2.1.x will allow us to seamlessly resolve this issue.

[whitlockjc]

swagger-tools will be getting an update too so it shouldn't matter, although I will push a 2.1.7 release as well.

[akeating]

Thanks, I do appreciate it. The current release of swagger-tools 0.10.1 will pick-up this new release 2.1.7 as follows;

From:

swagger-tools@0.10.1 > json-refs@2.1.6 > uri-js@2.1.1

To:

swagger-tools@0.10.1 > json-refs@2.1.7 > uri-js@3.0.2

[whitlockjc]

I understand. :)

[whitlockjc]

json-refs@v2.1.7 is released with the latest dependencies, which should resolve this issue: https://github.com/whitlockjc/json-refs/releases/tag/v2.1.7