Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability with dependency swagger-parser v10.0.2 #287

Open
bbakersc opened this issue Nov 19, 2021 · 1 comment
Open

Vulnerability with dependency swagger-parser v10.0.2 #287

bbakersc opened this issue Nov 19, 2021 · 1 comment
Labels
pinned Issues that will not be automatically closed

Comments

@bbakersc
Copy link

In our company's vulnerability scans this morning there was a security vulnerability discovered with a deep-down dependency of swagger parser v10.0.2 (z-schema v4.2.3 -> validator v13.6.0). It looks like this has been resolved with v10.0.3, so an upgrade of that dependency version to v10.0.3 seems to be in order.
@daniloab daniloab added the pinned Issues that will not be automatically closed label Nov 30, 2021
@lannonbr
Copy link

I see this was updated in the yarn.lock file in #300, but the changes don't seem to cascade when used due to the package.json still being a hard pin to 10.0.2. Would it be possible to cut a new release with a hard pin to 10.0.3?

Haegin added a commit to Haegin/swagger-jsdoc that referenced this issue Oct 17, 2022
@Haegin
Upgrade swagger-parser to fix vulnerability
4ab3e51 
Fixes Vulnerability with dependency swagger-parser v10.0.2 Surnet#287.

swagger-parser depends on z-schema, which depends on validator, and the
version that swagger-parser v10.0.2 depends on has a security
vulnerability (GHSA-xx4c-jj58-r7x6).

PR Surnet#300 tried to fix this, but because the version is pinned to 10.0.2
exactly in package.json it hasn't changed the version used.
@Haegin Haegin mentioned this issue Oct 17, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
pinned Issues that will not be automatically closed
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@lannonbr @daniloab @bbakersc