microsoft / BotFramework-WebChat

A highly-customizable web-based client for Azure Bot Services.
https://www.botframework.com/
MIT License
1.56k stars 1.51k forks source link

Warning for sanitize-html dependency #5137

Open pelanzag opened 3 months ago

pelanzag commented 3 months ago

Is it an issue related to Adaptive Cards?

No

Is this an accessibility issue?

No

What version of Web Chat are you using?

Latest production

Which distribution are you using Web Chat from?

Bundle (webchat.js)

Which hosting environment does this issue primarily affect?

Web apps

Which browsers and platforms do the issue happened?

No response

Which area does this issue affect?

Others or unrelated

What is the public URL for the website?

No response

Please describe the bug

There's a moderate vulnerability on the dependency sanitize-html as detailed at NIST CVE-2024-21501

sanitize-html  <2.12.1
Severity: moderate
sanitize-html Information Exposure vulnerability - https://github.com/advisories/GHSA-rm97-x556-q36h
fix available via `npm audit fix --force`
Will install botframework-webchat@0.15.0, which is a breaking change
node_modules/sanitize-html
  botframework-webchat  >=0.15.1-master.aeca50e
  Depends on vulnerable versions of sanitize-html
  node_modules/botframework-webchat

Can you please bump sanitize-html to the latest version?

Do you see any errors in console log?

sanitize-html  <2.12.1
Severity: moderate
sanitize-html Information Exposure vulnerability - https://github.com/advisories/GHSA-rm97-x556-q36h
fix available via `npm audit fix --force`
Will install botframework-webchat@0.15.0, which is a breaking change
node_modules/sanitize-html
  botframework-webchat  >=0.15.1-master.aeca50e
  Depends on vulnerable versions of sanitize-html
  node_modules/botframework-webchat


### How to reproduce the issue?

1. Navigate to root dir.
2. Run `npm audit fix`

### What do you expect?

I expect there to be no issues when running `npm audit fix`

### What actually happened?

I'm getting a warning when running `npm audit fix`

### Do you have any screenshots or recordings to repro the issue?

_No response_

### Adaptive Card JSON

_No response_

### Additional context

_No response_
OEvgeny commented 3 months ago

@compulim any idea why dependabot didn't report this?