@prisma/engine-core uses vulnerable undici 5.1.1 package

[valerii15298]

Bug description

@prisma/engine-core uses vulnerable undici 5.1.1 package. I believe prisma is modern and secure ORM, so there shoud be no security vulnerabilities.

How to reproduce

Install @prisma/sdk

pnpm add @prisma/sdk

Run pnpm audit

pnpm audit

┌─────────────────────┬───────────────────────────────────────────────────┐
│ high                │ ProxyAgent vulnerable to MITM                     │
├─────────────────────┼───────────────────────────────────────────────────┤
│ Package             │ undici                                            │
├─────────────────────┼───────────────────────────────────────────────────┤
│ Vulnerable versions │ >=4.8.2 <=5.5.0                                   │
├─────────────────────┼───────────────────────────────────────────────────┤
│ Patched versions    │ >=5.5.1                                           │
├─────────────────────┼───────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-pgw7-wx7w-2w33 │
└─────────────────────┴───────────────────────────────────────────────────┘

Expected behavior

Ther should be no security vulnerabilities!!!

Prisma information

@prisma/sdk 3.15.2

Environment & setup

Does not matter

Prisma Version

3.15.2

[janpio]

This has already been fixed for the next version which will be release next Tuesday: #13862

[shellscape]

@janpio y'all got bit by another one in undici:

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Regular Expression Denial of Service in                │
│                     │ Headers                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ undici                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <5.19.1                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=5.19.1                                               │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ typegraphql-prisma@0.24.3 >         │
│                     │ @prisma/internals@4.11.0 > @prisma/engine-core@4.11.0  │
│                     │ > undici@5.16.0                                        │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-r6ch-mqf9-qc9w      │
└─────────────────────┴────────────────────────────────────────────────────────┘

[janpio]

Fortunately again not exploitable in our context, as we define the headers to be used.
But again already a PR open that will be merged with more interest now I guess: #17803

[janpio]

And merged @shellscape, will be part of next week's release.