CVE-2020-7768

[chrisui]

Hello!

• Vote on this issue by adding a 👍 reaction
• To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already)

Issue details

Steps to reproduce

1. npm i @pulumi/policy
2. Get dependabot alerts refe

Expected: No issues Actual: Get github dependabot alert https://github.com/advisories/GHSA-pp75-xfpw-37g9

% npm ls @grpc/grpc-js
monorepo@0.1.0 /monorepo
├─┬ @pulumi/policy@v1.3.0
│ └── @grpc/grpc-js@0.6.18
└─┬ @pulumi/pulumi@3.21.0
  └── @grpc/grpc-js@1.3.8

% npm ls @pulumi/policy
monorepo@0.1.0 monorepo
├─┬ @pulumi/awsguard@v0.3.0
│ └── @pulumi/policy@v1.3.0 deduped
└── @pulumi/policy@v1.3.0

[chrsmith]

It looks like this was fixed in the @pulumi/policy repo a while ago, but we just haven't shipped it. So as a workaround you we can sync to @pulumi/policy 1.4.0-alpha.1638209268... but we should just cut a new release of that library. (And update our dependency to the newer, fixed version.)

[justinvp]

We've released v1.4.0 of @pulumi/policy which has the updated @grpc/grpc-js dependency.