pnp / pnp/sp-dev-fx-controls-react

Vulnerable transitive dependencies (ajv and fast-xml-parser) in @pnp/spfx-controls-react v3.24.x

Open
#2,121 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
433
Forks
418
Avg merge
5d 6m
Merged PRs (30d)
19

Description

Category

  • Enhancement

Version

3.24.0

Description

While upgrading an SPFx 1.23.0 solution, our security scan identified vulnerabilities in the transitive dependencies used by the latest @pnp/spfx-controls-react (v3.24.x).

The affected packages are:

  • fast-xml-parser (currently resolves to 4.5.6)
  • ajv (currently resolves to 8.13.0)
Image Image Image Image

The reported vulnerabilities include:

  • XML Entity Expansion
  • Regular Expression Denial of Service (ReDoS)
  • Improper Validation of Specified Quantity in Input

Expected / Desired Behavior

Please consider updating the vulnerable transitive dependencies to the latest compatible non-vulnerable versions, for example:

  • fast-xml-parser → 5.6.0
  • ajv → 8.20.0

This would eliminate the need for consumers to maintain manual dependency overrides and improve security compliance for solutions using @pnp/spfx-controls-react.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting the package manifests and dependency-resolution output for @pnp/spfx-controls-react v3.24.x, then trace which direct dependencies bring in ajv and fast-xml-parser. Verify compatible non-vulnerable versions and confirm the dependency tree and project checks no longer report the listed vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
react, typescript
Domain
build-system, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
62/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.