[BUG] `@asyncapi/multi-parser` still depending on vulnerable version of `jsonpath-plus`
- Dominant language
- TypeScript
- Stars
- 144
- Forks
- 144
- Avg merge
- 6m
- Merged PRs (30d)
- 11
Description
### Describe the bug.
There is a vulnerability in `jsonpath-plus` on versions earlier than `10.0.7`.
You already merged these two PRs (#1058, #1062), making the `@asyncapi/parser` package migrate to a safe version.
However, the `@asyncapi/multi-parser` package still depends on versions of `@asyncapi/multi-parser` (`parserapiv1` as well as `parserapiv2`) that use older versions of `jsonpath-plus` (`7.2.0`).
Would it be possible to release patches for `2.1.0` and `3.0.0-next-major-spec.8` of `@asyncapi/parser` that use the safe version of `jsonpath-plus` and then make `@asyncapi/multi-parser` use these versions?
### Expected behavior
`@asyncapi/multi-parser` should only rely on `jsonpath-plus@>10.0.7`
### Screenshots
Here the (relevant) output of `npm why jsonpath-plus` after running `npm install @asyncapi/multi-parser` on a blank npm package:
```
jsonpath-plus@7.2.0
node_modules/parserapiv1/node_modules/jsonpath-plus
jsonpath-plus@"^7.2.0" from parserapiv1@2.1.2
node_modules/parserapiv1
parserapiv1@"npm:@asyncapi/parser@^2.1.0" from @asyncapi/multi-parser@2.2.0
node_modules/@asyncapi/multi-parser
@asyncapi/multi-parser@"^2.2.0" from the root project
jsonpath-plus@7.2.0
node_modules/parserapiv2/node_modules/jsonpath-plus
jsonpath-plus@"^7.2.0" from parserapiv2@3.0.0-next-major-spec.8
node_modules/parserapiv2
parserapiv2@"npm:@asyncapi/parser@3.0.0-next-major-spec.8" from @asyncapi/multi-parser@2.2.0
node_modules/@asyncapi/multi-parser
@asyncapi/multi-parser@"^2.2.0" from the root project
```
### How to Reproduce
Install `@asyncapi/multi-parser` and find the versions of `jsonpath-plus` that got installed.
### 🥦 Browser
None
### 👀 Have you checked for similar open issues?
- [X] I checked and didn't find similar issue
### 🏢 Have you read the Contributing Guidelines?
- [X] I have read the [Contributing Guidelines](https://github.com/asyncapi/.github/blob/master/CONTRIBUTING.md)
### Are you willing to work on this issue ?
None
Contributor guide
Research direction
Install @asyncapi/multi-parser in a blank package and run npm why jsonpath-plus to reproduce the vulnerable dependency tree. Inspect the parserapiv1 and parserapiv2 package dependencies and the @asyncapi/multi-parser version references; done means both paths resolve jsonpath-plus to a version above 10.0.7 and patched parser releases are used.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100