jsonwebtoken is breaking Firebase Admin SDK

[motss]

[READ] Step 1: Are you in the right place?

• For issues or feature requests related to the code in this repository file a Github issue.
  • If this is a feature request make sure the issue title starts with "FR:".
• For general technical questions, post a question on StackOverflow with the firebase tag.
• For general Firebase discussion, use the firebase-talk google group.
• For help troubleshooting your application that does not fall under one of the above categories, reach out to the personalized Firebase support channel.

[REQUIRED] Step 2: Describe your environment

• Operating System version: macOS Sierra 10.12.5
• Firebase SDK version: 5.0.0
• Library version: Node.js 8.1.2 + NPM 5.0.3
• Firebase Product: -

[REQUIRED] Step 3: Describe the problem

Steps to reproduce:

As a regular snyk user, running snyk test to check for vulnerabilities of all NPM dependencies and the latest Firebase Admin could not pass the test and discovered that jsonwebtoken is the culprit. See the image below for more details:

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[hiranya911]

What exactly is the problem here? Can you provide more details about the type of error/vulnerability found in jsonwebtoken?

[motss]

@hiranya911 When running snyk test command, it will check all the NPM dependencies and it hit the jsonwebtoken dependency inside the firebase-admin with the error Invalid error: Invalid version: "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-7.2.0.tgz and the snyk check stops and never able to complete the vulnerability check.

Is this something related to firebase-admin?

[hiranya911]

I still don't understand what the problem is. Why is 7.2.0 an invalid version? It is not the latest version available (latest seems to be 7.4.1). But it should be fine to depend on an older version.

[hiranya911]

I'm closing this, as it appears this is not a Firebase SDK issue. Check the referenced snyk issue for more context.