CVE in a package dependency

[ssheladiya]

Where do we report if there is a know CVE in one of the dependency?

[ssheladiya]

@kmcginnes maybe you have some idea around that?

[kmcginnes]

You can create a GitHub issue with the details if it is already public knowledge (i.e. Docker found issues or some other automated tool).

If it is a new vulnerability that is not public knowledge, then we would like the chance to close it before it becomes public. We don't have many non-public forms of communication for this project yet. But you can find me and some of my other team mates on the Tinkerpop Discord server.

[kmcginnes]

Actually, I stand corrected. The repo Readme section has a "Security" tab that has all the security reporting information and useful links.

https://github.com/aws/graph-explorer?tab=security-ov-file