Open bbellmyers opened 1 month ago
Hi @bbellmyers, We do not automatically consider supply chain vulnerability as bugs: the vulnerable code needs to be used for the product to be vulnerable (and thus qualify as a bug).
In this specific case, ws
is only used by react-native-get-random-values
, which is used only when using coveo.analytics in a react-native context.
Headless doesn't do so, nor does it support it.
So, while we'll try to 'plug' this hole in the future, we don't think this a bug and will not prioritize it like one.
Which product are you using?
Headless
product version
2.73.0
bug description
@coveo/headless version 2.73.0 depends on ws@6.2.3, which is flagged as insecure by GitHub (https://github.com/advisories/GHSA-3h5v-q93c-6h6q)
Steps to reproduce
While some versions have been back-patched, GitHub still flags if ws version is less than 8.17.1
Relevant log output