adobe / adobe/aio-lib-photoshop-api
Update dependencies with vulnerabilities
- Dominant language
- JavaScript
- Stars
- 27
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
Hi there!
Thanks for the nice npm package to use the Photoshop API, it really made my current automisation task easier.
When working with the package I realized that it uses some outdated npm dependencies. Especially the `swagger-client` has already some newer versions available that fix vulnerabilities. It should be safe to at least update its version from `3.9.6` to the current version `3.19.10`. This would already fix a lot of reported vulnerabilities. Here is a part of the report:
```
# npm audit report
cross-fetch <=2.2.5 || 3.0.0 - 3.1.4 || 3.2.0-alpha.0 - 3.2.0-alpha.2
Severity: high
Incorrect Authorization in cross-fetch - https://github.com/advisories/GHSA-7gc6-qh9x-w6h8
Depends on vulnerable versions of node-fetch
No fix available
node_modules/swagger-client/node_modules/cross-fetch
swagger-client 3.0.1 - 3.11.1
Depends on vulnerable versions of cross-fetch
Depends on vulnerable versions of fast-json-patch
node_modules/swagger-client
@adobe/aio-lib-photoshop-api *
Depends on vulnerable versions of swagger-client
node_modules/@adobe/aio-lib-photoshop-api
fast-json-patch <3.1.1
Severity: high
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability - https://github.com/advisories/GHSA-8gh8-hqwg-xf34
No fix available
node_modules/fast-json-patch
node-fetch <=2.6.6
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
The `size` option isn't honored after following a redirect in node-fetch - https://github.com/advisories/GHSA-w7rc-rwvf-8q5r
No fix available
node_modules/swagger-client/node_modules/node-fetch
```
Contributor guide
Research direction
Start with the npm dependency manifest and lockfile, then run npm audit to reproduce the reported vulnerabilities. Update the declared swagger-client dependency from 3.9.6 toward 3.19.10, check compatibility with the package, and confirm the audit results and existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100