search

hygraph / rich-text

A set of companion packages for Hygraph's Rich Text Field
MIT License
93 stars 18 forks source link

Update @graphcms/html-to-slate-ast to use newer versions of Slate #102

Closed vanbujm closed 10 months ago

vanbujm commented 1 year ago

@graphcms/html-to-slate-ast lists the following as peer deps:

# required peer-dependancies
npm install slate@0.58.3 slate-hyperscript@0.58.3
npm install @graphcms/html-to-slate-ast

Installing slate@0.58.3 introduces critical security issues according to npm audit

Severity: critical
Prototype Pollution in immer - https://github.com/advisories/GHSA-c36v-fmgq-m8hx
Prototype Pollution in immer - https://github.com/advisories/GHSA-33f9-j839-rf8h
fix available via `npm audit fix --force`
Will install slate@0.94.1, which is a breaking change
node_modules/immer
  slate  0.50.0 - 0.66.0-2021725134429 || >=1.0.0-2021312830
  Depends on vulnerable versions of immer
  node_modules/slate
iamgabrielsoft commented 1 year ago

the bug report is true

It has been fixed immer(v0.94.1)

I updated it

https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa https://github.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237

jpedroschmitz commented 10 months ago

Hey! I opened #110, which will fix the issue. We can't update to the latest Slate, but we can update to 0.66.1, which resolves the vulnerability issue as it updates Immer to 9.0.6, which has the issue fixed.

jpedroschmitz commented 10 months ago

We release 0.13.2 which fixes the issue!