search

ory / integrations

Apache License 2.0
19 stars 24 forks source link

Remove "request" dependency due to security vulnerability? CVE-2023-28155 #51

Closed justin-wilxite closed 5 months ago

justin-wilxite commented 1 year ago

The dependency "request" has a security vulnerability (reported by npm audit):

https://github.com/advisories/GHSA-p8p7-x288-28g6

The "request" library itself is deprecated:

https://github.com/request/request/issues/3142

There is a PR on the project to fix the vulnerability, but it looks like it will not be merged:

https://github.com/request/request/pull/3444

Eskotus commented 1 year ago

Looks like it's not even used in the repository. Was it just forgotten in the deps?

dan-j commented 5 months ago

Looks like this was addressed here: https://github.com/ory/integrations/pull/60

Just needs a release cutting from main. Is there a plan to do this soon?

aeneasr commented 5 months ago

Thank you for letting us know - release is triggerd! Closing issue

aeneasr commented 5 months ago

Looks like tests are failing: https://github.com/ory/integrations/actions/runs/8434909650/job/23099169259

Would appreciate help fixing the issues!

dan-j commented 5 months ago

Tests pass locally on node 21, GitHub Actions are on 17.. do you want to upgrade, or fix the test on 17?

dan-j commented 5 months ago

The version of next used on main requires >=18.17.0, if that helps answer your question? I've confirmed that tests pass on v18.19.1