npm audit --fix fails

[SchoolGuy]

What happened?

Due to GHSA-pxg6-pf52-xh8x currently Jitsi cannot be installed from source.

cookie  <0.7.0
cookie accepts cookie name, path, and domain with out of bounds characters - https://github.com/advisories/GHSA-pxg6-pf52-xh8x
No fix available
node_modules/cookie
  express  >=3.0.0-alpha1
  Depends on vulnerable versions of cookie
  node_modules/express
    webpack-dev-server  *
    Depends on vulnerable versions of express
    node_modules/webpack-dev-server

3 low severity vulnerabilities

Platform

• Chrome (or Chromium based)
• Firefox
• Safari
• Other desktop browser
• Android browser
• iOS browser
• Electron app
• Android mobile app
• iOS mobile app
• Custom app using a mobile SDK

Browser / app / sdk version

2.0.9753

Relevant log output

No response

Reproducibility

• The problem is reproducible on meet.jit.si

More details?

When webpack-dev-server has updated to a version of express that is not vulnerable anymore, the fix is as simple as increasing the version in package.json.

Express already has a PR that addresses that. As such this is already in motion: expressjs/express#6017

[MMDH05]

Have the same issue. I want to try upgrading my dependencies but I might break something

[SchoolGuy]

@MMDH05 The jitsi team can do nothing until webpack-dev-server released a new version. As such we just need to stay patient. The issue is just a tracker.

[SchoolGuy]

This is still not fixable since webpack/webpack-dev-server#5329 is open in webpack-dev-server. Sadly it seems that no update for the last two weeks since express 4.21.1 is out has been published. As such the Jitsi team is still unable to patch this issue and Jitsi cannot be built from source due to the failing npm audit --fix (especially in airgapped environments where the cache needs to be up-to-date for the sake of npm).

[saghul]

It absolutely can be installed from source. Use your own common sense to decide if the warnings are relevant or not.

In this case, the offending package is used by a development library, which is not part of the Jitsi Meet build artifacts, so it's safe to ignore.