mapbox / mapbox/mapbox-gl-directions

Mapbox Directions depends on vulnerable versions of lodash.template

Open
#322 1 comment 0 reactions 0 assignees View on GitHub
auto-triaged bug
Dominant language
JavaScript
Stars
255
Forks
130
PR merge metrics
No merged PRs in 30d

Description

Hi,

I'm starting to work with mapbox directions but I'm having a hard time installing the api and using it. After running "npm install @mapbox/mapbox-directions"

I'm getting the following error:

lodash.template *
Severity: high
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
No fix available
node_modules/lodash.template
@mapbox/mapbox-gl-directions *
Depends on vulnerable versions of lodash.template
node_modules/@mapbox/mapbox-gl-directions

Is there something that I need to update on my end?

Thanks!

Contributor guide

Open the contributing guide

Research direction

The issue names no source file, test, or entry point; begin by reproducing the npm install output and inspecting the dependency tree for @mapbox/mapbox-gl-directions and lodash.template. Done would require a supported dependency resolution that removes the high-severity advisory, with installation and security checks passing.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.