Skip to content

Indirect dependency vulnerability through @asyncapi/generator #574

Description

@anfern777

Describe the bug
"request" package has known vulnerabilities and is present in nestjs-asyncapi dependency tree through @asyncapi/generator

Details
The request package, which is deprecated and has known vulnerabilities, is being included as a transitive dependency in the nestjs-asyncapi package. Below is the detailed dependency chain:

nestjs-asyncapi@1.3.0
├── @asyncapi/generator@1.13.1
│   └── @npmcli/arborist@^2.2.4
│       └── @npmcli/metavuln-calculator@^1.1.0
│           └── pacote@^11.1.11
│               └── @npmcli/run-script@^1.8.2
│                   └── node-gyp@^7.1.0
│                       └── request
└── @asyncapi/generator@1.13.1
    └── @npmcli/arborist@^2.2.4
        └── @npmcli/run-script@^1.8.2
            └── node-gyp@^7.1.0
                └── request

Proposed solution
Upgrade @asyncapi/generator dependency to its latest minor version

Additional context
Full description of the vulnerability here: GHSA-p8p7-x288-28g6

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions