Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Request for dependency updates to address critical / major vulnerabilities

Open
  • Is something wrong?
#5,846 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
angular, javascript
Domain
frontend, security

Research direction

Start by running npm audit --production and tracing the reported paths for speech-sdk, swiper, and request. Review the linked Adaptive Cards issue and the stated Angular and request blockers; done means the vulnerable dependencies are updated or the remaining unfixable blockers are clearly documented.

Written by the indexing model from the issue text.

Description

Bot Services bug customer-reported
Is it an issue related to Adaptive Cards?

No response

Is this an accessibility issue?

No response

What version of Web Chat are you using?

Latest production

Which distribution are you using Web Chat from?

NPM

Which hosting environment does this issue primarily affect?

Web apps

Which browsers and platforms do the issue happened?

No response

Which area does this issue affect?

Others or unrelated

Which theme pack does this issue affect?

I did not test it on other theme packs

What is the public URL for the website?

http://virtualagent.hpcloud.hp.com/

Please describe the bug

Critical Issues

  1. [email protected] - Prototype Pollution Currently pinned for adaptivecards compatibility. Versions 6.5.1-12.1.1 are vulnerable, fix is 12.2.0. Advisory: GHSA-hmx5-qpq5-p643
  2. form-data < 2.5.4 - Unsafe Random + CRLF Injection Comes from deprecated request package. No fix available since request is unmaintained. Advisories: GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx
  3. @angular/common ⇐ 19.2.15 - XSRF Token Leak Transitive dependency from [email protected]. Fix available in 19.2.16+. Advisory: GHSA-58c5-g7wp-6w37
  4. @angular/core ⇐ 18.2.14 - XSS Issues Also from [email protected]. Multiple XSS vulnerabilities in i18n and SVG handling. Advisories: GHSA-prjf-86w9-mfqv, GHSA-g93w-mfhg-p222, GHSA-jrmj-c5cx-3cw6

High Severity Issues :

(same speech-sdk blocker as above):
5. @angular/common: GHSA-p3vc-36g9-x9gr (DoS via OOM), GHSA-q6f4-qqrg-jv6x (Info Leak), GHSA-48r7-hpm6-gfxm (DoS)
6. @angular/core: GHSA-rgjc-h3x7-9mwg (DOM Clobbering), GHSA-692r-grfm-v8x7 (Template XSS)

What's Blocking Fixes

  • Speech SDK 1.17.0 pulls in old Angular versions
  • Adaptive Cards needs swiper v8 specifically
  • The request package is deprecated with no replacement

What Would Help
If you could update:

  1. Speech SDK to use fixed Angular versions
  2. Adaptive Cards to work with swiper 12+ (logged separately https://github.com/microsoft/AdaptiveCards/issues/9381)
  3. Replace request with a maintained HTTP client
Do you see any errors in console log?
How to reproduce the issue?

n/a

What do you expect?

If you could update:

  1. Speech SDK to use fixed Angular versions
  2. Adaptive Cards to work with swiper 12+ (NOTE: this will be logged as an issue in the AdaptiveCard repo)
  3. Replace request with a maintained HTTP client
What actually happened?

n/a

Do you have any screenshots or recordings to repro the issue?

n/a

Adaptive Card JSON
Additional context

Vulnerabilities discovered via npm audit --production

Dominant language
HTML
Stars
1.8k
Forks
1.6k
Avg merge
17h 55m
Merged PRs (30d)
3

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/BotFramework-WebChat

All issues in microsoft/BotFramework-WebChat

Similar issues

More Web Dev issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.