search

dotansimha / graphql-code-generator

A tool for generating code based on a GraphQL schema and GraphQL operations (query/mutation/subscription), with flexible support for custom plugins.
https://the-guild.dev/graphql/codegen/
MIT License
10.87k stars 1.34k forks source link

Security issue: @babel/traverse has an exploit for versions < 7.23.2 #9789

Open aaronclong opened 11 months ago

aaronclong commented 11 months ago

Which packages are impacted by your issue?

@graphql-codegen/cli, @graphql-codegen/add, @graphql-codegen/typescript-resolvers, @graphql-codegen/typescript

Describe the bug

This is less of a bug but more of security issue, @babel/traverse has an exploit in it. My company's security scanning tool has detected this, and it is also been detected by Github security. Auditing my company's internal app's lockfile and using yarn why, I've notice your app has depency on these versions with exploits.

Admittedly, I am not exceptional at reading yarn lock files, but I have found affect versions in your lockfile:

Your Example Website or App

...

Steps to Reproduce the Bug or Issue

Please check this page from github security: https://github.com/advisories/GHSA-67hx-6x53-jw92

Expected behavior

To upgrade this dep and maintain functionality

Screenshots or Videos

No response

Platform

Codegen Config File

No response

Additional context

You might want to introduce a security template in your issues.

abhishek-parative commented 9 months ago

Any mitigration plans?