SECURITY: Vulnerability in transient dependency

[manuelkiessling]

Here is the output of NSP:

yarn run nsp check
yarn run v1.3.2
$ /.bin/nsp check
(+) 1 vulnerability found
┌────────────┬────────────────────────────────────────────────────────────────────┐
│            │ Prototype pollution attack                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Name       │ hoek                                                               │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ CVSS       │ 4 (Medium)                                                         │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Installed  │ 2.16.3                                                             │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Vulnerable │ <= 4.2.0 || >= 5.0.0 < 5.0.3                                       │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Patched    │ > 4.2.0 < 5.0.0 || >= 5.0.3                                        │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ Path       │ redacted > uppy-server@0.11.1 >                  │
│            │ grant-express@3.8.0 > grant@3.8.0 > request@2.81.0 > hawk@3.1.3 >  │
│            │ hoek@2.16.3                                                        │
├────────────┼────────────────────────────────────────────────────────────────────┤
│ More Info  │ https://nodesecurity.io/advisories/566                             │
└────────────┴────────────────────────────────────────────────────────────────────┘

Also see simov/grant/issues/86 for the issue in the project which can actually fix the problem.

[ifedapoolarewaju]

@manuelkiessling thank you for reporting this. I'll look into it.

[simov]

👋 I've resolved the security issue in Grant v4, so all you need to do is bump the version here. Also check out the changelog. Migration should be pretty straightforward.

Let me know if you have any issues!

[ifedapoolarewaju]

@simov I did run into an issue after upgrading to Grant 4. See here

[simov]

Fixed in version 4.0.1 🎉

[ifedapoolarewaju]

upgraded, thanks for all the input in this 😉

[manuelkiessling]

@ifedapoolarewaju and @simov, thank you so much for doing such an awesome job for all of us, highly appreciated!