search

Azure / azure-sdk-for-node

Azure SDK for Node.js - Documentation
https://github.com/Azure/azure-sdk-for-node#documentation
MIT License
1.19k stars 566 forks source link

Need ms-rest-azure to reference the new version of adal-node in their dependencies (0.2.2) #5212

Closed WilliamRADFunk closed 2 years ago

WilliamRADFunk commented 2 years ago

I'm with the Azure Portal team.

We have a S360 code security bug in relation to a dependency (xmldom) that is being referenced by adal-node (prior to 0.2.x), which in turn is being referenced by ms-rest-azure (latest adal-node version reference is ^0.1.28). The bug wants the version of xmldom to be upgraded from 0.6.0 to 0.7.0, but the problem is that xmldom transitioned from xmldom to @xmldom/xmldom prior to versioning up from 0.6.0. Since adal-node referenced the old way "xmldom" (pre 0.2.x), it's not getting the "@xmldom/xmldom" version. They are now referencing it properly in 0.2.2.

Ultimately, we need the "adal-node": "^0.1.28" to be changed to something like so "adal-node": "^0.2.2" in ms-rest-azure's package.json dependencies list.

qiaozha commented 2 years ago

close this issue as PR merged. @WilliamRADFunk feel free to let me know if you still find issues. Thanks