Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Indirect dependency vulnerability through @asyncapi/generator #574

Open
anfern777 opened this issue Aug 1, 2024 · 2 comments
Open

Indirect dependency vulnerability through @asyncapi/generator #574

anfern777 opened this issue Aug 1, 2024 · 2 comments

Comments

@anfern777
Copy link

Describe the bug
"request" package has known vulnerabilities and is present in nestjs-asyncapi dependency tree through @asyncapi/generator

Details
The request package, which is deprecated and has known vulnerabilities, is being included as a transitive dependency in the nestjs-asyncapi package. Below is the detailed dependency chain:

nestjs-asyncapi@1.3.0
├── @asyncapi/generator@1.13.1
│   └── @npmcli/arborist@^2.2.4
│       └── @npmcli/metavuln-calculator@^1.1.0
│           └── pacote@^11.1.11
│               └── @npmcli/run-script@^1.8.2
│                   └── node-gyp@^7.1.0
│                       └── request
└── @asyncapi/generator@1.13.1
    └── @npmcli/arborist@^2.2.4
        └── @npmcli/run-script@^1.8.2
            └── node-gyp@^7.1.0
                └── request

Proposed solution
Upgrade @asyncapi/generator dependency to its latest minor version

Additional context
Full description of the vulnerability here: GHSA-p8p7-x288-28g6

Copy link

github-actions bot commented Aug 1, 2024

Hello! Thank you for filing an issue.

If this is a bug report, please include relevant logs to help us debug the problem.

@lc-spxl
Copy link

lc-spxl commented Sep 12, 2024

I confirm this issue. Would the update to a recent async release introduce BC ?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants