firebase / firebase/firebase-functions-test

Request for Release Timeline for Vulnerability Fixes (ts-deepmerge & js-yaml)

Open
#325 2 comments 3 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
248
Forks
63
PR merge metrics
No merged PRs in 30d

Description

Hello Team,

We noticed that the dependency vulnerabilities reported in the project include issues related to ts-deepmerge and js-yaml.

The ts-deepmerge vulnerability appears to have already been addressed, and the corresponding PR has been merged.
The js-yaml vulnerability, however, does not appear to be fixed yet.

Could you please provide an estimated timeline for the next release that will include:

The merged ts-deepmerge fix.
A fix for the js-yaml vulnerability (if one is planned or currently in progress).

We would appreciate any update on the release schedule, as these vulnerabilities are impacting our dependency compliance requirements.

Thank you for your support.

Contributor guide

Open the contributing guide

Research direction

Review the vulnerability reports for ts-deepmerge and js-yaml and confirm the release status of the merged ts-deepmerge fix. Check the project's release process; done means providing the requested timeline and stating whether a js-yaml fix is planned.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
release, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.