Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update tsconfig-paths dependency #2711

Closed
monkollek opened this issue Feb 8, 2023 · 1 comment
Closed

Update tsconfig-paths dependency #2711

monkollek opened this issue Feb 8, 2023 · 1 comment

Comments

@monkollek
Copy link

The current version of eslint-plugin-import uses tsconfig-paths 3.14.1

The issue with this version is that it's dependency json5 1.0.1 is dependent on minimist 1.2.0 which has a vulnerability
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

The latest version of tsconfig-paths 4.1.2 uses json 2.2.2 which does not have the minimist 1.2.0 dependency/vulnerability.

@ljharb
Copy link
Member

ljharb commented Feb 8, 2023

  1. the vulnerability is in json5, not tsconfig-paths
  2. we depend on tsconfig-paths v3, which depends on json5 v1
  3. json5 v1 and v2 both have the fix published, so all you need to do is update your lockfile
  4. this is not actually a valid vulnerability for this plugin anyways, so it's irrelevant
  5. tsconfig-paths v4 is absolutely a breaking change because it drops, among others, node 4 - see [Deps] upgrade tsconfig-paths to ^4.0.0 #2447

This is a duplicate of #2625; a duplicate of #2628; a duplicate of #2626; a duplicate of #2627; a duplicate of #2631; a duplicate of #2632; a duplicate of #2634; a duplicate of #2635; a duplicate of #2636; a duplicate of #2637; a duplicate of #2639; a duplicate of #2642; a duplicate of #2643; a duplicate of #2649; a duplicate of #2655; a duplicate of #2660; a duplicate of #2670; a duplicate of #2692.

@ljharb ljharb closed this as not planned Won't fix, can't repro, duplicate, stale Feb 8, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants