Dependency url-signature using a version of crypto-js with critical vulnerability

[elrond30]

Hi, looks like the package.json is using url-signature 1.0.4, which use a version of crypto-js with critical vulnerability. There is an opened issue in js-url-signature with a Pull Request, to update crypto-js version and solve the vulnerability.

googlemaps/js-url-signature#446

Thanks.

[wangela]

If you would like to upvote the priority of this issue, please comment below or react on the original post above with 👍 so we can see what is popular when we triage.

@elrond30 Thank you for opening this issue. 🙏
Please check out these other resources that might help you get to a resolution in the meantime:

• Check the issue tracker - bugs and feature requests for Google Maps Platform APIs and SDKs
• Open a support case - Get 1:1 support in Cloud Console.
• Discord - chat with other developers
• StackOverflow - use the google-maps tag

This is an automated message, feel free to ignore.

[wangela]

v1.0.30 of js-url-signature has been released with the updated dependency. We'll need to update the dependency in this library to pull that in.

[wangela]

@usefulthink after you merge #1046, could you update this dependency? Causing a CVE.

[wangela]

Since the dependency range in the current package.json includes minor and patch releases of js-url-signature at or above v1.0.4, this library now will pull in v1.0.30 without any changes required (may require an npm audit fix for existing projects). Lowering priority to update the listed dependency at next sensible update.

[wangela]

Fixed by #1110

[elrond30]

Thank you for the fix