ionic-team / ionic-cli

The Ionic command-line interface
MIT License
1.99k stars 640 forks source link

fix(cli): resolve vm2 security vulnerability #5070

Closed sean-perkins closed 5 months ago

sean-perkins commented 5 months ago

Ionic CLI currently reports a security vulnerability with the vm2 dependency as a result of superagent-proxyproxy-agent.

The superagent-proxy package is a smaller wrapper around superagent and proxy-agent that is not maintained.

This PR removes the dependency for superagent-proxy and upgrades to proxy-agent@6 which no longer has the vm2 dependency requirement. The proxy-agent package uses ESM & as a result a lot of other usages had to be migrated once esmoduleInterop was enabled. The proxy behavior that superagent-proxy was responsible for has been added here: https://github.com/ionic-team/ionic-cli/blob/4332a24af67b98424ff19083a6f9e2e09a66c0a8/packages/%40ionic/cli/src/lib/utils/superagent-proxy.ts

Here is the error message without esmoduleInterop:

node_modules/get-uri/dist/http.d.ts:5:8 - error TS1192: Module '"http"' has no default export.

5 import http_ from 'http';
         ~~~~~

node_modules/get-uri/dist/http.d.ts:6:8 - error TS1192: Module '"https"' has no default export.

6 import https from 'https';
         ~~~~~

node_modules/proxy-agent/dist/index.d.ts:3:8 - error TS1259: Module '"/Users/sean/Documents/ionic/ionic-cli/packages/@ionic/cli/node_modules/proxy-agent/node_modules/lru-cache/index"' can only be default-imported using the 'esModuleInterop' flag

3 import LRUCache from 'lru-cache';
         ~~~~~~~~

  node_modules/proxy-agent/node_modules/lru-cache/index.d.ts:869:1
    869 export = LRUCache
        ~~~~~~~~~~~~~~~~~
    This module is declared with 'export =', and can only be used with a default import when using the 'esModuleInterop' flag.

Found 3 errors in 2 files.

Errors  Files
     2  node_modules/get-uri/dist/http.d.ts:5
     1  node_modules/proxy-agent/dist/index.d.ts:3