search

deepgram / deepgram-js-sdk

Official JavaScript SDK for Deepgram's automated speech recognition APIs.
https://developers.deepgram.com
MIT License
127 stars 45 forks source link

Transitive dependency on es5-ext causes socket.dev / snyk errors #288

Closed lox closed 1 month ago

lox commented 1 month ago

What is the current behavior?

Currently due to websocket having a dependency on es5-ext the deepgram package is causing failures in builds that rely on socket.dev and snyk for dependency scanning.

The issues is that es5-ext publishes protest banners. I have zero interest in the politics, but from my perspective it's a breach of trust that makes it a supply chain risk.

Steps to reproduce

Run a build with socket.dev.

image

See https://socket.dev/npm/package/@deepgram/sdk

Expected behavior

No critical errors.

Fixes

This can be resolved by adding this to your package.json:

  "resolutions": {
    "es5-ext": "0.10.53"
  },
lukeocodes commented 1 month ago

Wow, thanks. I'll review this first thing and get a patch out

We have a draft PR for removing that websocket library, should be released as 3.4.x this week

lukeocodes commented 1 month ago

release for this and another vuln just pushed out