RuntimeTools / appmetrics

Node Application Metrics provides a foundational infrastructure for collecting resource and performance monitoring data for Node.js-based applications.
https://developer.ibm.com/open/node-application-metrics/
Apache License 2.0
970 stars 125 forks source link

Upgrade jszip to 3.x to resolve CVE-2021-23413 #656

Open lux01 opened 2 years ago

lux01 commented 2 years ago

Appmetrics currently uses jszip@2.x which has a prototype pollution vulnerability:

This PR upgrades the jszip dependency to ^3.7.0 and consequently tweaks the headless_zip.js functions to be more async friendly as zip.generate() has been replaced by zip.generateAsync().

This fixes #655.

Additionally I had to fix a unit test failure that occurs when running on macOS 11 (caused by os.name now returning macOS rather than Mac OS X) to ensure my changes still passed the unit tests.