Skip to content

Remove js-yaml from @RocketSoftware/eureka-js-client #1057

@ChongZhou-Broadcom

Description

@ChongZhou-Broadcom

@RocketSoftware/eureka-js-client 4.5.9 is used in zlux-server-framework, which introduced a transitive dependency "js-yaml@3.14.1":

*[zhou/upgrade-js-yaml][~/Work/Zowe/zowe/zlux-server-framework]$ npm list js-yaml
zlux-server-framework@0.0.0-zlux.version.replacement /Users/cz667581broadcom.com/Work/Zowe/zowe/zlux-server-framework
├─┬ @rocketsoftware/eureka-js-client@4.5.9
│ └── js-yaml@3.14.1
├─┬ mocha@11.2.2
│ └── js-yaml@4.1.1
└─┬ swagger-parser@10.0.3
  └─┬ @apidevtools/swagger-parser@10.0.3
    └─┬ @apidevtools/json-schema-ref-parser@9.1.2
      └── js-yaml@4.1.1

However, Blackduck scan showed that "js-yaml@3.14.1" has high security issue and the recommended version is 4.1.1.

@1000TurquoisePogs checked the code and believes that js-yaml is not actually used when @RocketSoftware/eureka-js-client 4.5.9 is used in Zowe, so we may remove this vulnerable dependency by removing the code from eureka-js-client that calls js-yaml.

(There is code that calls js-yaml to load the eureka's yaml configuration, but Zowe does not actually use eureka configuration file)

Metadata

Metadata

Assignees

No one assigned

    Labels

    backlogpriority-lowAn issue that is recognized by the squad but that is not considered very important

    Type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions