Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump crypto-js in sdk-server-edge package #311

Closed

Conversation

cymruu
Copy link

@cymruu cymruu commented Nov 8, 2023

Requirements

  • I have added test coverage for new or changed functionality
  • I have followed the repository's pull request submission guidelines
  • I have validated my changes against all supported platform versions

Related issues
GHSA-xwcq-pm8m-c4vf
https://nvd.nist.gov/vuln/detail/CVE-2023-46233
Describe the solution you've provided

Bump crytpo-js version to resolve vulnerability reported by tools such as pnpm audit.
image
GitHub link advisory GHSA-xwcq-pm8m-c4vf

Describe alternatives you've considered

None

Additional context
I couldn't find any usage of the vulnerable algorithm in the LaunchDarkly codebase, so most likely LaunchDarkly users aren't affected. Nevertheless, I believe it's important to address this issue to maintain clean security reports for repositories using this package.

@cymruu cymruu changed the title build(deps): bump core-js in sdk-server-edge package build(deps): bump crypto-js in sdk-server-edge package Nov 8, 2023
@kinyoklion
Copy link
Member

Hello @cymruu,

Thank you for the contribution. It appears that we have this dependency in a number of packages. I think we should bump them all, for consistency. (functionally I don't think it will be different).

Thank you,
Ryan

@github-actions github-actions bot added the Stale label Feb 14, 2024
@github-actions github-actions bot closed this Feb 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants