firebase / firebase/firebase-functions

transitive dependency @tootallnate/once has an advisory and is flaged as a low vulnerability

Open
#1,835 2 comments 2 reactions 1 assignee Claimed by @IzaakGough View on GitHub
Dominant language
TypeScript
Stars
1.1k
Forks
232
Avg merge
20h 46m
Merged PRs (30d)
15

Description

Unable to update dependency on vulnerable npm package. I tried doing this with dependabot in my project:

Dependabot cannot update @tootallnate/once to a non-vulnerable version The latest possible version that can be installed is 2.0.0 because of the following conflicting dependencies:
firebase-functions-test@3.4.1 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
firebase-functions@7.0.5 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
firebase-admin@13.6.1 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
No patched version available for @tootallnate/once The earliest fixed version is 3.0.1.

GitHub advisory: https://github.com/advisories/GHSA-vpq2-c234-7xj6

http-proxy-agent is currently at 8.0.0.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.