-
Notifications
You must be signed in to change notification settings - Fork 41
Open
Labels
backlogpriority-lowAn issue that is recognized by the squad but that is not considered very importantAn issue that is recognized by the squad but that is not considered very important
Description
@RocketSoftware/eureka-js-client 4.5.9 is used in zlux-server-framework, which introduced a transitive dependency "js-yaml@3.14.1":
*[zhou/upgrade-js-yaml][~/Work/Zowe/zowe/zlux-server-framework]$ npm list js-yaml
zlux-server-framework@0.0.0-zlux.version.replacement /Users/cz667581broadcom.com/Work/Zowe/zowe/zlux-server-framework
├─┬ @rocketsoftware/eureka-js-client@4.5.9
│ └── js-yaml@3.14.1
├─┬ mocha@11.2.2
│ └── js-yaml@4.1.1
└─┬ swagger-parser@10.0.3
└─┬ @apidevtools/swagger-parser@10.0.3
└─┬ @apidevtools/json-schema-ref-parser@9.1.2
└── js-yaml@4.1.1
However, Blackduck scan showed that "js-yaml@3.14.1" has high security issue and the recommended version is 4.1.1.
@1000TurquoisePogs checked the code and believes that js-yaml is not actually used when @RocketSoftware/eureka-js-client 4.5.9 is used in Zowe, so we may remove this vulnerable dependency by removing the code from eureka-js-client that calls js-yaml.
(There is code that calls js-yaml to load the eureka's yaml configuration, but Zowe does not actually use eureka configuration file)
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
backlogpriority-lowAn issue that is recognized by the squad but that is not considered very importantAn issue that is recognized by the squad but that is not considered very important
Type
Projects
Status
No status