search

microsoft / ApplicationInsights-node.js

Microsoft Application Insights SDK for Node.js
MIT License
320 stars 138 forks source link

Transitive vulnerable import-in-the-middle #1180

Closed baywet closed 10 months ago

baywet commented 11 months ago

Once this gets fixed in @azure/opentelemetry-instrumentation-azure-sdk https://github.com/Azure/azure-sdk-for-js/issues/26756 and released, it should be updated here as well and released.

hectorhdzg commented 11 months ago

@baywet thanks for reporting the issue, talked to Azure SDK folks yesterday and the will be releasing soon so we will include this as part of next release happening right after.

baywet commented 11 months ago

@hectorhdzg this has been updated on the Azure SDK front, @azure/opentelemetry-instrumentation-azure-sdk is now available. Can you roll out the update please?

DevRCRun commented 11 months ago

Am I correct in thinking this issue is not network facing in the usual use case where appinsights is instrumenting node modules subsequently loaded in a project (i.e. express)? (that is the module name / location to import is supplied by the developer by virtue of them having built the project - rather than the vulnerability being susceptible to the actual telemetry data itself)

hectorhdzg commented 10 months ago

This should be fixed in 2.7.1 now