search

zooniverse / Panoptes-Front-End

Front end for zooniverse/Panoptes
https://www.zooniverse.org
Apache License 2.0
64 stars 76 forks source link

[Security] security warning for superagent during builds #7143

Open eatyourgreens opened 1 month ago

eatyourgreens commented 1 month ago

Building PFE generates the following security warning in the build output (during the npm ci step.)

superagent@8.1.2: Please upgrade to v9.0.0+ as we have fixed a public vulnerability with formidable dependency. Note that v9.0.0+ requires Node.js v14.18.0+. See https://github.com/ladjs/superagent/pull/1800 for insight. This project is supported and maintained by the team at Forward Email @ https://forwardemail.net

Superagent probably needs to be upgraded in the API client, rather than directly in PFE. See https://github.com/zooniverse/panoptes-javascript-client/pull/243.

eatyourgreens commented 1 month ago

The new API client, in the monorepo, is built on top of Superagent 8 too, so this warning affects all Zooniverse frontend projects (including Lab, Classrooms, Translations etc.)

https://github.com/zooniverse/front-end-monorepo/blob/f7b56e15c9b890535ef674caf623c130e48f32f5/packages/lib-panoptes-js/package.json#L19-L22

eatyourgreens commented 1 month ago

Here’s the PR that’s linked from that warning.