JSON5 vulnerability in v7.x of ember-cli-babel
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- babel, javascript
- Domain
- build-system, security
Research direction
Start by reviewing pull request #511 and the dependency chain from ember-cli-babel 7.26.11 through babel-plugin-module-resolver and find-babel-config to json5 0.5.1. Done means a patch release of the 7.x line allows projects to remove json5 0.5.1 from their lockfiles and addresses the linked vulnerability.
Written by the indexing model from the issue text.
Description
ember-cli-babel version 7.x is still widely used in the ember community, over 65% of downloads from npm are still on 7.x. There is a vulnerability in JSON5 being brought in from a transitive dependency of this package, that has been updated in ember-cli-babel 8.x. However it is impossible to remove version 7.x from ember projects given ember-source itself still depends on 7.x, along with many other ember community packages. I am hoping a patch version of ember 7.x could be released to remove this vulnerability.
This proposed PR should allow projects to get JSON5 0.5.1 out of their lockfiles https://github.com/emberjs/ember-cli-babel/pull/511
See vulnerability: https://security.snyk.io/vuln/SNYK-JS-JSON5-3182856
The dependency chain bringing in 0.5.1:
└─┬ ember-cli-babel 7.26.11
└─┬ babel-plugin-module-resolver 3.2.0
└─┬ find-babel-config 1.2.0
└── json5 0.5.1
- Dominant language
- JavaScript
- Stars
- 152
- Forks
- 115
- Avg merge
- 23h 22m
- Merged PRs (30d)
- 4
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from emberjs/ember-cli-babel
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
emberjs/ember-cli-babel#508 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
emberjs/ember-cli-babel#535 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
emberjs/ember-cli-babel#533 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
emberjs/ember-cli-babel#519 · 6 comments · 8 reactions ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
emberjs/ember-cli-babel#517 ·
All issues in emberjs/ember-cli-babel
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·