search

forcedotcom / lwc-dev-server-feedback

LWC Local Development
BSD 3-Clause "New" or "Revised" License
45 stars 10 forks source link

a vulnerability CVE-2020-28469 is introduced in @salesforce/lwc-dev-server #123

Open ayaka-kms opened 3 years ago

ayaka-kms commented 3 years ago

Hi, a vulnerability CVE-2020-28469 is introduced in @salesforce/lwc-dev-server via: ● @salesforce/lwc-dev-server@2.10.0 ➔ cpx@1.5.0 ➔ chokidar@1.7.0 ➔ glob-parent@2.0.0

However, cpx is a legacy package, which has not been maintained for about 5 years. Is it possible to migrate cpx to other package to remediate this vulnerability?

I noticed several migration records in other js repo for cpx:

  1. in commitizen, version 2.10.1 ➔ 3.0.0, remove cpx via commit
  2. in @s-ui/studio, version 10.12.0 ➔ 10.13.0, migrate cpx to copyfiles via commit
  3. in taninsam, migrate from cpx to cpx2 via commit

Are there any efforts planned that would remediate this vulnerability or migrate cpx?

Thanks ; )

randi274 commented 3 years ago

@smaddox-sf is this something we should be considering for our backlog?

stale[bot] commented 3 years ago

This issue has been automatically marked as type:bug-p3 because it has not had recent activity.