emberjs / emberjs/ember-cli-babel

JSON5 vulnerability in v7.x of ember-cli-babel

Open
#512 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
152
Forks
115
Avg merge
23h 22m
Merged PRs (30d)
4

Description

ember-cli-babel version 7.x is still widely used in the ember community, over 65% of downloads from npm are still on 7.x. There is a vulnerability in JSON5 being brought in from a transitive dependency of this package, that has been updated in ember-cli-babel 8.x. However it is impossible to remove version 7.x from ember projects given [ember-source](https://github.com/emberjs/ember.js/blob/main/package.json#L91) itself still depends on 7.x, along with many other ember community packages. I am hoping a patch version of ember 7.x could be released to remove this vulnerability.

This proposed PR should allow projects to get JSON5 0.5.1 out of their lockfiles https://github.com/emberjs/ember-cli-babel/pull/511

See vulnerability: https://security.snyk.io/vuln/SNYK-JS-JSON5-3182856

The dependency chain bringing in 0.5.1:
```
└─┬ ember-cli-babel 7.26.11
└─┬ babel-plugin-module-resolver 3.2.0
└─┬ find-babel-config 1.2.0
└── json5 0.5.1

```

![Screenshot 2024-04-12 at 2 37 34 PM](https://github.com/emberjs/ember-cli-babel/assets/17480686/a9b2650e-6047-4826-8283-f3f9479a053e)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.