search

graphql / graphql-playground

🎮 GraphQL IDE for better development workflows (GraphQL Subscriptions, interactive docs & collaboration)
MIT License
8.75k stars 730 forks source link

Update `graphiql` dependency #1367

Open SimenB opened 2 years ago

SimenB commented 2 years ago

This issue pertains to the following package(s):

What OS and OS version are you experiencing the issue(s) on?

N/A

What version of graphql-playground(-electron/-middleware) are you experiencing the issue(s) on?

1.7.28

What is the expected behavior?

There should be no security warnings from GitHub/npm.

What is the actual behavior?

graphiql@0.17.5 has the following advisory: https://github.com/advisories/GHSA-x4r7-m2q9-69c8.

It also pulls in a version of markdown-it with https://github.com/advisories/GHSA-6vfc-qv3f-vr6c

Additionally, the version this module depends on of isomorphic-fetch pulls in a node-fetch with https://github.com/advisories/GHSA-r683-j2x4-v87g & https://github.com/advisories/GHSA-w7rc-rwvf-8q5r

What steps may we take to reproduce the behavior?

npm install graphql-playground-react && npm audit

Please provide a gif or image of the issue for a quicker response/fix.

# npm audit report

graphiql  0.5.0 - 1.4.7-canary-85a66743.0
Severity: high
GraphiQL introspection schema template injection attack - https://github.com/advisories/GHSA-x4r7-m2q9-69c8
Depends on vulnerable versions of markdown-it
No fix available
node_modules/graphiql
  graphql-playground-react  *
  Depends on vulnerable versions of graphiql
  node_modules/graphql-playground-react

markdown-it  <12.3.2
Severity: moderate
Uncontrolled Resource Consumption in markdown-it - https://github.com/advisories/GHSA-6vfc-qv3f-vr6c
No fix available
node_modules/graphiql/node_modules/markdown-it
  graphiql  0.5.0 - 1.4.7-canary-85a66743.0
  Depends on vulnerable versions of markdown-it
  node_modules/graphiql
    graphql-playground-react  *
    Depends on vulnerable versions of graphiql
    node_modules/graphql-playground-react

node-fetch  <=2.6.6
Severity: high
The `size` option isn't honored after following a redirect in node-fetch - https://github.com/advisories/GHSA-w7rc-rwvf-8q5r
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
fix available via `npm audit fix`
node_modules/isomorphic-fetch/node_modules/node-fetch
  isomorphic-fetch  2.0.0 - 2.2.1
  Depends on vulnerable versions of node-fetch
  node_modules/isomorphic-fetch
    fbjs  0.7.0 - 1.0.0
    Depends on vulnerable versions of isomorphic-fetch
    node_modules/fbjs
      react  0.15.0-alpha.1 - 16.4.2
      Depends on vulnerable versions of fbjs
      node_modules/react
        react-dom  0.15.0-alpha.1 - 16.4.2
        Depends on vulnerable versions of fbjs
        Depends on vulnerable versions of react
        node_modules/react-dom
          react-codemirror  >=1.0.0
          Depends on vulnerable versions of react-dom
          node_modules/react-codemirror

9 vulnerabilities (5 low, 1 moderate, 3 high)