a vulnerability CVE-2021-33587 is introduced in ember-cli-addon-docs-esdoc
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 25/100
- Issue type
- Refactor
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- javascript
Research direction
Start by tracing the reported dependency chain from ember-cli-addon-docs-esdoc@0.4.0 through esdoc and cheerio to css-what. Review the linked Crest2D and wootils migrations from esdoc to jsdoc for applicable guidance. Done means selecting and implementing a supported migration that removes the vulnerable dependency while preserving the addon's documentation behavior.
Written by the indexing model from the issue text.
Description
Hi, @rwwagner90, a vulnerability CVE-2021-33587 is introduced in ember-cli-addon-docs-esdoc via:
● ember-cli-addon-docs-esdoc@0.4.0 ➔ esdoc@1.1.0 ➔ cheerio@1.0.0-rc.2 ➔ css-select@1.2.0 ➔ css-what@2.1.3
However, esdoc is a legacy package, which has not been maintained for about 2 years.
Is it possible to migrate esdoc to other package to remediate this vulnerability?
I noticed a migration record in other js repo for esdoc:
● in crest2d, version 1.1.2, migrated from esdoc to jsdoc via commit
● in wootils, version 3.0.4, migrated from esdoc to jsdoc via commit
Are there any efforts planned that would remediate this vulnerability or migrate esdoc?
Thanks.
- Dominant language
- JavaScript
- Stars
- 2
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from ember-learn/ember-cli-addon-docs-esdoc
-
Custom ESdoc config Open
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
Difficulty 4/5 3-5 days Newbie friendliness 20/100
All issues in ember-learn/ember-cli-addon-docs-esdoc
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Issue-Bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
sugarlabs/musicblocks#8924 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
ArduPilot/ardupilot_wiki#8088 ·
-
[BUG] createTool tools cannot be registered with Mastra when exactOptionalPropertyTypes is enabled Opencustomer-eng status: needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 84/100