Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug]: Dependency on expr-eval creates vulnerability #241

Closed
skapplersic opened this issue Jan 5, 2024 · 1 comment · Fixed by #244
Closed

[Bug]: Dependency on expr-eval creates vulnerability #241

skapplersic opened this issue Jan 5, 2024 · 1 comment · Fixed by #244
Assignees
@jorenbroekema
Labels
bug Something isn't working

Comments

@skapplersic
Copy link

What happened?

Any version of this package above @0.5.3 has a dependency on a version of expr-eval that is flagged as a high severity vulnerability by Sonatype IQ Server. The issue was also addressed in the expr-eval repo. That package is no longer in active development, so it's unlikely that it will be fixed there.

Reproduction

No response

Expected output

No response

Version

0.12.2
@skapplersic skapplersic added bug Something isn't working triage To be reproduced as bug labels Jan 5, 2024
@skapplersic skapplersic changed the title [Bug]: [Bug]: Dependency on expr-eval creates vulnerability Jan 5, 2024
@jorenbroekema jorenbroekema removed the triage To be reproduced as bug label Jan 10, 2024
@jorenbroekema jorenbroekema mentioned this issue Jan 10, 2024
Merged
@skapplersic
Copy link
Author

Thanks for the quick response! 💯

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jorenbroekema jorenbroekema

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix: use expr-eval fork to fix security issue tokens-studio/sd-transforms
2 participants
@jorenbroekema @skapplersic