Bump vm2 to resolve critical CVE

Question

Bump vm2 to resolve critical CVE

ZackKanter opened this issue a year ago · comments

There's a Dependabot PR open for bumping vm2 from 3.9.17 to 3.9.18. This would resolve the critical CVE in vm2 3.9.17 that currently affects this repo. It would be great to get this merged ASAP.

Zack Kanter · Answer 1 · Thu May 25 2023 20:50:31 GMT+0800 (China Standard Time)

Ah, I see that the release 23.1 branch removes vm2 altogether.

Luis Francisco Perez Villegas · Answer 2 · Thu May 25 2023 23:17:39 GMT+0800 (China Standard Time)

Hi Zack,
Thanks for pointing out.
Yes we are in the process of releasing a new version that even removes completely vm2. It would be ready soon.
Regards

Luis Francisco Perez Villegas · Answer 3 · Fri May 26 2023 17:58:25 GMT+0800 (China Standard Time)

Hi again,
We have just released version 1.7.3 on npm. Please check it out.
This version removes entirely vm2 dependency so the CVE does not longer apply on it.
Regards.

Zack Kanter · Answer 4 · Fri May 26 2023 20:17:10 GMT+0800 (China Standard Time)

Hi again,
We have just released version 1.7.3 on npm. Please check it out.
This version removes entirely vm2 dependency so the CVE does not longer apply on it.
Regards.

This worked as expected – thank you!