Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update fast-sourcemap-concat to remove dependency lodash.template for consumer apps (security vulnerability) #1969

Merged

Conversation

mkszepp
Copy link
Contributor

@mkszepp mkszepp commented Jun 10, 2024

The package fast-sourcemap-concat v1 brings as dependency sourcemap-validator see.
sourcemap-validator brings as dependency lodash.template see which has security vulnerability GHSA-35jh-r3h4-6jhm

fast-sourcemap-concat v2 doesn't bring anymore the dependency sourcemap-validator, so we don't have anymore the lodash.template dependency in consumer app and we solve the security vulnerability for them.

Internal in embroider addon the vulnerabilty is also present after this changes, because there is the devDependency ember-cli-eslint, which brings in deep still fast-sourcemap-concat v1.
ember-cli-eslint is a deprecated package and should be replaced with eslint see - RFC

So we have some options to remove this vulnerability inside embroider addon:

  1. Replace ember-cli-eslint with eslint
  2. Updating in broccoli-lint-eslint the dependency broccoli-concat from v3 to v4 (because broccoli-concat v3 brings fast-sourcemap-concat v1) broccoli-lint-eslint package - broccoli-concat

Of course, the addon will still have this lodash.template vulnerability, because tests are against old ember versions < 5.4 are shipping this dependency (but we reduce this dependency in cases in which there is possible)

Let me know whats your idea and if we should to fix the internal vulnerability in this PR or in an following. The owner of all packages, which are still shipping fast-sourcemap-concat v1 is always ember

@mkszepp
Copy link
Contributor Author

mkszepp commented Jun 10, 2024

i think the faling tests are not directly related to the change

@mansona mansona added the bug Something isn't working label Jun 13, 2024
@mansona mansona merged commit 88b11ad into embroider-build:stable Jun 13, 2024
203 checks passed
@mkszepp mkszepp deleted the update-fast-sourcemap-concat-stable branch June 13, 2024 14:26
@github-actions github-actions bot mentioned this pull request Jun 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants