Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

@slack/client dependency "async" has a security vulnerability #639

Open
5 tasks
ReubenUnruh opened this issue Apr 21, 2022 · 2 comments
Open
5 tasks

@slack/client dependency "async" has a security vulnerability #639

ReubenUnruh opened this issue Apr 21, 2022 · 2 comments
Labels
Milestone

Comments

@ReubenUnruh
Copy link

Description

npm audit wants me to fix the security issue Prototype Pollution in async

# npm audit report

async  <2.6.4
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@slack/client/node_modules/async
├─┬ [email protected]
│ └─┬ @slack/[email protected]
│   ├── [email protected]
│   └─┬ [email protected]
│     └── [email protected]

What type of issue is this? (place an x in one of the [ ])

  • [ x] bug
  • enhancement (feature request)
  • question
  • documentation related
  • testing related
  • discussion

Requirements (place an x in each of the [ ])

  • [x ] I've read and understood the Contributing guidelines and have done my best effort to follow them.
  • [ x] I've read and agree to the Code of Conduct.
  • [x ] I've searched for any related issues and avoided creating a duplicate issue.

Bug Report

Reproducible in:

hubot-slack version: 4.10.0

node version: v16.13.2

OS version(s): Windows 10

Steps to reproduce:

  1. Install hubot-slack v4.10.0

Expected result:

No audit suggestions

Actual result:

Audit suggests rolling back to hubot 2.x

@seratch seratch added this to the 4.x milestone Apr 26, 2022
@jimmywarting
Copy link

@slack/client is also now a legacy... maybe you should switch to something else?

@joeyguerra
Copy link

I'm in the process of removing the async module from Hubot and have also created a new Slack adapter if you're interested in that route.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants