Update the dependency better-ajv-errors to version 0.8.2 or later because of a vulnerability in its dependency - jsonpointer

Question

Update the dependency better-ajv-errors to version 0.8.2 or later because of a vulnerability in its dependency - jsonpointer

rahuljeswani1995 opened this issue 3 years ago · comments

rahuljeswani1995 commented 3 years ago

Update better-ajv-errors to version 0.8.2 or later because of a vulnerability in its dependency - jsonpointer
Github advisory for the vulnerability - GHSA-282f-qqgm-c34q.
Although the advisory shows this as a moderate vulnerability, Trivy scans (https://github.com/aquasecurity/trivy) flag it as a critical vulnerability. The dependency better-ajv-errors has already been updated to have the correct version (5.0.0) of the vulnerable dependency jsonpointer in its version 0.8.2 - atlassian/better-ajv-errors@2513443.

jaime echegaray zipper · Answer 1 · Fri Nov 19 2021 05:42:59 GMT+0800 (China Standard Time)

Hi, thanks for the warning! can you make a pull request?

rahuljeswani1995 · Answer 2 · Fri Nov 19 2021 06:23:02 GMT+0800 (China Standard Time)

Unfortunately, I can't. I tried to clone and build deepstream server on my machine, but it gave me an error message - No XCode or CLT version detected. Furthermore, I am unable to install Xcode on my Mac, because it wants the latest version of Mac OS installed, which I can't do on my work laptop.
I believe the change is simply to update the dependency better-ajv-errors in package.json from version 0.6.7 to 0.8.2 and you would also need to do a bit of regression testing.
I'd really appreciate it if you could make this update. I would have done it myself if I could.