NPM Audit: Prototype pollution in async

[zachleat]

• jake dependency (filed at Update "async": Security vulnerability, prototype pollution jakejs/jake#408) via ejs
  • alternatively please remvove jake as not needed in production - fixes CVE-2021-43138 mde/ejs#659
• portscanner dependency (no issue yet https://github.com/baalexander/node-portscanner) via browser-sync

async  <2.6.4
Severity: high
Prototype Pollution in async - https://github.com/advisories/GHSA-fwr7-v2mv-hh25
fix available via `npm audit fix --force`
Will install @11ty/eleventy@0.3.3, which is a breaking change
node_modules/async
node_modules/portscanner/node_modules/async
  jake  >=8.0.1
  Depends on vulnerable versions of async
  node_modules/jake
    ejs  >=3.1.2
    Depends on vulnerable versions of jake
    node_modules/ejs
      @11ty/eleventy  >=0.3.4
      Depends on vulnerable versions of browser-sync
      Depends on vulnerable versions of ejs
      node_modules/@11ty/eleventy
  portscanner  0.1.1 - 2.1.1
  Depends on vulnerable versions of async
  node_modules/portscanner
    browser-sync  <=0.6.2 || >=2.0.0-rc1
    Depends on vulnerable versions of portscanner
    node_modules/browser-sync

[zachleat]

Applies to both 1.x and 2.x branches, although I expect that this will be fixed upstream in a minor dependency bump.

[zachleat]

jakejs/jake#408 was merged and a new version was shipped.

This is now fixed on 2.x but still applicable to 1.x via the browser-sync dep.

See also this issue filed for the 2.x eleventy-server-browsersync plugin 11ty/eleventy-server-browsersync#2

[sentience]

Looks like portscanner@2.2.0 already allows the fix, async@2.6.4.

browser-sync@2.27.9 (latest) specifies exactly portscanner@2.1.1, so I guess that's where an issue/fix is needed.

[SphinxKnight]

On browser-sync repo, matching:

• issue async portscanner vulnerability 2.1.1 BrowserSync/browser-sync#1959
• PR Updated portscanner to 2.2.0 BrowserSync/browser-sync#1960

[shakyShane]

released as browser-sync@2.27.10 - thank you :)

[zachleat]

~/Temp/eleventy-install-may-18-2022 ᐅ npm install @11ty/eleventy           

added 322 packages, and audited 323 packages in 7s

26 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

Verified, thank you @shakyShane!