@google-cloud/pubsub@2.5.0 includes dependencies with security vulnerabilities

[rvillane]

node-forge v0.9.1 was recently identified with high severity vulnerability CVE-2020-7720 [1]. The issue has been solved in v0.10.0

└─┬ @google-cloud/pubsub@2.5.0
  └─┬ google-auth-library@6.0.6
    └─┬ gtoken@5.0.3
      └─┬ google-p12-pem@3.0.2
        └── node-forge@0.9.1 

[1] https://www.npmjs.com/advisories/1561

[cermakja]

The json-bigint module dependency also needs to be upgraded to 1.0.0 remediate a security issue.

Prototype Pollution
Vulnerable module: json-bigint
Introduced through: @google-cloud/pubsub@2.5.0
Exploit maturity: Proof of concept
Fixed in: 1.0.0

Affected versions of this package are vulnerable to Prototype Pollution via the parse function.

https://app.snyk.io/vuln/SNYK-JS-JSONBIGINT-608659

[feywind]

Thanks for the notes, everyone. I'll get that PR looked at and see if I can throw in a quick fix for the json-bigint entry as well.

I'm also having a conversation with others on the team to see if there's a way we can improve the transitive dependency issue on things like the auth library.

[feywind]

Ahh thanks, GitHub :P I need to reopen this for the second package above.

[feywind]

I'll need to do another PR for this library once that one is updated.

I was asked to pass along that our general intent with transitive dependencies is basically:

rm -rf node_modules package-lock.json && npm i

(Of course if you really do need to lock versions, you can also manually bump the version of a dependency from your project.)

In other words, because of the depth and complexity of the average Node package's package graph, it's not generally practical for us to maintain minimum versions upstream for every fix, so the recommended thing is just to refresh your versions once in a while to make sure you have compatible fixes.

[feywind]

Oh, GitHub. :sigh:

[csombok]

Thanks for the fix. Do you know the date when the new official version will be available with the vulnerability fixes?

[feywind]

@csombok It should be up already, actually - 2.6.0.