Closed massongit closed 11 months ago
Thanks for reporting this! To set expectations:
Finally, please be patient with the core team. They are trying their best with limited resources.
esbuild
(a popular build tool for JavaScript and TypeScript written in Go) recently switched to an approach that avoids dependencies and postinstall scripts altogether. The creator of esbuild
wrote down a very nice explanation of the technique and its pros and cons here:
https://github.com/evanw/esbuild/pull/1621
swc
(a similar tool written in Rust) already used that technique, too.
This might be viable for Elm too. Leaving this here in case it helps future decisions!
Request 2.88.2
depends on form-data 2.3.3
, which depends on json-schema 0.2.3
json-schema 0.2.3 has a critical vulnerability: https://github.com/advisories/GHSA-896r-f27r-55mw
Which is a problem for using Elm. If you org needs to comply with security audits (like us).
So it would be really good to change this
FYI: The request
dependency is being removed in https://github.com/elm/compiler/pull/2287
hi @lydell since https://github.com/elm/compiler/pull/2287 is no longer going to be completed (in the near future) would it be possible to:
request
request
with one of its alternativesI'm willing to help or take the lead on any of those options.
@adrian-gomez I’m not sure I understand what you mean. Could we chat about it on Slack perhaps?
Do you plan to merge https://github.com/elm/compiler/pull/2287 ?
This issue has been outstanding for 2 years. The following security advisory is well known about the request package:
The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).
The npm package
request
is under maintenance mode: https://github.com/request/request/issues/3142 Therefore, you need to changerequest
to other packages.Alternative libraries to request: https://github.com/request/request/issues/3143