box / box-node-sdk

A Javascript interface for interacting with the Box API. You can find the node package at
https://www.npmjs.com/package/box-node-sdk
Apache License 2.0
187 stars 121 forks source link

Bump proxy-agent to 6.4.0 to resolve CVE-2023-42282 #873

Closed VarunWachaspati closed 6 months ago

VarunWachaspati commented 6 months ago

Description of the Issue

box-node-sdk is affected by CVE-2023-42282. Need to bump up proxy-agent to 6.4.0which addresses the above CVE by removing the vulnerable dependency.

Versions Used

Node SDK: 3.4.2

VarunWachaspati commented 6 months ago

Raised a PR to address the above issue - https://github.com/box/box-node-sdk/pull/874. Kindly take a look at this whenever possible.

congminh1254 commented 6 months ago

Hi @VarunWachaspati

Thanks for your PR, this fix will included in the next release.

Bests, Minh

VarunWachaspati commented 6 months ago

Hey @congminh1254

Thanks for merging the PR. Any idea when the next release would be done?

congminh1254 commented 6 months ago

Hi @VarunWachaspati

We have just released the version 3.5.0 of box-node-sdk.

Please check it, if you need anything else, let us know.