search

Automattic / vip-decoupled-bundle

WordPress VIP decoupled plugin bundle
28 stars 5 forks source link

Vulnerability Alert for WPGraphQL Plugin Version 1.17.0 in WPVIP Environment #75

Closed jffry93 closed 8 months ago

jffry93 commented 9 months ago

I downloaded the vip-decoupled-bundle plugin and added it to the repo and vipbot is catching a vulnerability. I have attached a screenshot of the issue caught below.

Bug Report Bot Comment: wpcomvip-vipgoci-bot (VIP Code Analysis Bot) reported a vulnerability 33 minutes ago.

Screenshot 2023-12-08 at 1 16 03 PM
smithjw1 commented 9 months ago

Thanks for reporting this! We'll look to get this updated ASAP. In the meantime, you can remove this version of WP GraphQL from the bundle and install WP GraphQL directly.

The other bundle functions will detect and use that installation.

smithjw1 commented 9 months ago

I chatted with @alecgeatches about this, and he pointed out that the scanner is reporting the delta between our version and the most recent version. There isn't a vulnerability.

Scanning the changelog, I see no reported security fixes in the 1.18 or 1.19.

We will work to update this to the latest version, but you can feel confident using the current version until we do so.