microsoft / microsoft/azure-pipelines-task-lib
`UUID` GitHub Advisory to update to 14.0.0
Open
Area: TaskLib
triage
- Dominant language
- TypeScript
- Stars
- 458
- Forks
- 282
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 14
Description
See #1112 that I opened previously but has gone stale.
Internal scanners are picking up UUID 3.4.0 (the current version used by this project) as a vulnerability. The latest version is 14.0.0. Are there any plans to update this dependency or otherwise drop it?
https://github.com/advisories/GHSA-w5hq-g745-h8pq
Contributor guide
Research direction
Begin by locating where this project declares UUID 3.4.0 and review the linked GitHub Advisory. Determine whether updating to 14.0.0 or removing the dependency is compatible with the TypeScript library; done means the advisory is no longer reported and the existing checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100