Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security Issue and Deprecation Warning in jsdoc-parse due to lodash.pick #297

Closed
phuongnguyen2302 opened this issue Jan 29, 2024 · 2 comments

Comments

@phuongnguyen2302
Copy link

phuongnguyen2302 commented Jan 29, 2024

Problem
Jsdoc-to-markdown currently is using the latest version 6.2.0 of jsdoc-parse, which utilizes lodash.pick version 4.4.0. Lodash.pick has been flagged for a security issue as documented here. This poses a potential risk to the security of the project.
Furthermore, according to the lodash documentation available here, the use of lodash.pick is discouraged, and it is mentioned that it will be removed in version 5.

node_modules/lodash.pick
  jsdoc-parse  >=2.0.2
  Depends on vulnerable versions of lodash.pick
  node_modules/jsdoc-to-markdown/node_modules/jsdoc-parse
    jsdoc-to-markdown  0.6.0 - 0.6.4 || >=2.0.0-alpha.0
    Depends on vulnerable versions of jsdoc-parse
    node_modules/jsdoc-to-markdown

Requested Action
Is there any plan to address this issue in a future release of jsdoc-to-markdown? If so, could you provide an estimated timeline for the fix?
In the interim, are there any recommended measures or workarounds to mitigate the security risk associated with the current use of lodash.pick in jsdoc-parse?

Environment
jsdoc-to-markdown: 8.0.0
jsdoc-parse version: 6.2.0

@mknudsen
Copy link

I created a PR here jsdoc2md/jsdoc-parse#40 .

@75lb 75lb closed this as completed in 98a3310 Jan 31, 2024
@75lb
Copy link
Member

75lb commented Jan 31, 2024

PR merged and released in jsdoc-to-markdown v8.0.1 - thanks for letting me know.. These security warnings are completely irrelevant for offline, occassional-use command line dev tools but hey ho..

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

3 participants