search

APSL / redux-i18n

A simple and powerful package for translate your react applications using react-redux.
MIT License
233 stars 52 forks source link

a vulnerability CVE-2020-7598 is introduced in redux-i18n #133

Closed ayaka-kms closed 1 year ago

ayaka-kms commented 3 years ago

Hi, @francescarpi, a vulnerability CVE-2020-7598 is introduced in redux-i18n via: ● redux-i18n@1.5.23 ➔ optimist@0.6.1 ➔ minimist@0.0.10

optimist is a legacy package. It has not been maintained for about 8 years, and is not likely to be updated. Is it possible to migrate optimist to other package to remediate this vulnerability?

I noticed several migration records for optimist in other js repos, such as

  1. in handlebars, version 4.7.3-->4.7.4, migrate optimist to yargs via commit
  2. in db-migrate, version 1.0.0-beta.2-->1.0.0-beta.3, migrate optimist to yargs via commit
  3. in http-server, version 0.12.1-->0.12.2, deprecated optimist and directly use minimist via commit

Are there any efforts planned that would remediate this vulnerability or migrate optimist?

Thanks ; )

JoshMLeslie commented 2 years ago

Is this lib deprecated? This is a critical vulnerability I'd like to see fixed. The change is super small, I wouldn't mind making a PR for this, but it seems adding branches to this repo is prohibited

AndreeWille commented 1 year ago

I would also like to have it fixed. To me it looks like migrating to minimist is easily done. I would be willing to create a PR if that helps.

francescarpi commented 1 year ago

Hi @AndreeWille . I will be grateful if you can send me a PR, please. Thanks.

AndreeWille commented 1 year ago

any feedback to the PR would be appreciated.

francescarpi commented 1 year ago

Hi @AndreeWille , yes, sorry. I need to be relaxed for look your PR (and comments) with calm. I'm going to answer you soon. Thx

AndreeWille commented 1 year ago

Hi @francescarpi,

thanks a lot. I totally understand that you are working on other things and might have limited time.

francescarpi commented 1 year ago

PR #150 merged! Thanks a lot.