Update fast-sourcemap-concat
to remove dependency lodash.template
for consumer apps (security vulnerability)
#1969
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The package
fast-sourcemap-concat
v1 brings as dependencysourcemap-validator
see.sourcemap-validator
brings as dependencylodash.template
see which has security vulnerability GHSA-35jh-r3h4-6jhmfast-sourcemap-concat
v2 doesn't bring anymore the dependencysourcemap-validator
, so we don't have anymore thelodash.template
dependency in consumer app and we solve the security vulnerability for them.Internal in embroider addon the vulnerabilty is also present after this changes, because there is the devDependency
ember-cli-eslint
, which brings in deep stillfast-sourcemap-concat
v1.ember-cli-eslint
is a deprecated package and should be replaced witheslint
see - RFCSo we have some options to remove this vulnerability inside embroider addon:
ember-cli-eslint
witheslint
broccoli-lint-eslint
the dependencybroccoli-concat
from v3 to v4 (becausebroccoli-concat
v3 bringsfast-sourcemap-concat
v1) broccoli-lint-eslint package - broccoli-concatOf course, the addon will still have this
lodash.template
vulnerability, because tests are against old ember versions< 5.4
are shipping this dependency (but we reduce this dependency in cases in which there is possible)Let me know whats your idea and if we should to fix the internal vulnerability in this PR or in an following. The owner of all packages, which are still shipping
fast-sourcemap-concat
v1 is always ember