This project currently has known vulnerabilities in transitive dependencies, as reported by automated tools (e.g., Dependabot, npm audit). These vulnerabilities are present due to requirements of upstream dependencies and cannot be resolved directly within this project at this time.
- Advisories:
- GHSA-xwcq-pm8m-c4vf (PBKDF2 much weaker than standard)
- GHSA-3w3w-pxmm-2w2j (Insecure random numbers)
- Origin:
crypto-jsis a transitive dependency ofzapier-platform-coreviafernet.- This project does not use
crypto-jsdirectly.
- Mitigation:
- Do not use
crypto-jsdirectly in your own code. - Monitor for updates to
zapier-platform-coreandfernetthat address these vulnerabilities. - If you are forking or extending this project, avoid introducing direct usage of
crypto-js.
- Do not use
- Advisory:
- Origin:
esbuildis a transitive dependency of dev tools such asviteandvitest.- This project does not use
esbuilddirectly in production code.
- Mitigation:
- Only affects development environments. Do not expose dev servers to untrusted networks.
- Monitor for updates to
vite,vitest, and related tools.
- Advisory:
- Origin:
- Used by dev dependencies only.
- Mitigation:
- Only affects development environments. Monitor for updates to dev tools.
- Do not use vulnerable packages directly in your own code.
- Monitor upstream dependencies (
zapier-platform-core,fernet,vite,vitest, etc.) for security updates. - Update this project as soon as upstream fixes are available.
- Document these issues for your team and users.
If you discover a security issue in this project, please open an issue or contact the maintainers. If the issue is in an upstream dependency, consider reporting it to the relevant project as well.