Security Vulnerability in crypto-js (GHSA-xwcq-pm8m-c4vf)

[cameron-brown-future]

Type of issue

Dependency Update due to Security Vulnerability

Description

• A critical vulnerability has been found in the dependency crypto-js
• Details can be seen here: GHSA-xwcq-pm8m-c4vf
• This is causing npm audit to fail, with the suggested fix being to downgrade to prebid.js 1.27, which is not acceptable.

Steps to reproduce

Run npm audit in a project with prebid.js installed via the package.json

Expected results

npm audit should suggest a newer version of prebid.js with the vulnerable package updated

Actual results

npm audit suggests a downgrade to prebid.js 1.27

Platform details

Mac OS

[patmmccann]

@allanjun or @osazos please take a look

[patmmccann]

Fixed