@docusaurus/core@2.2.0 depends on a deep dependency got@9.6.0 which is a vulnerable version

[xnivaxhzne]

Have you read the Contributing Guidelines on issues?

• I have read the Contributing Guidelines on issues.

Prerequisites

• I'm using the latest version of Docusaurus.
• I have tried the npm run clear or yarn clear command.
• I have tried rm -rf node_modules yarn.lock package-lock.json and re-installing packages.
• I have tried creating a repro with https://new.docusaurus.io.
• I have read the console error message carefully (if applicable).

Description

@docusaurus/core@2.2.0 depends on a deep dependency got@9.6.0 which is a vulnerable version

Dependency Map:

@docusaurus/core@2.2.0
  └─┬ update-notifier@5.1.0
    └─┬ latest-version@5.1.0
      └─┬ package-json@6.5.0
        └── got@9.6.0

Observations:

got@11.8.5 and above are the bug free ones
package-json@8.0.0 and above contains the above got package version
latest-version@7.0.0 and above contains the above package-json package version
update-notifier@6.0.1 and above contains the above latest-version package version
But, @docusaurus/core@2.2.0 contains only the update-notifier@5.1.0 which has vulnerable got.

Useful Links:

https://www.npmjs.com/package/got
https://nvd.nist.gov/vuln/detail/CVE-2022-33987

Reproducible demo

No response

Steps to reproduce

Run npm ls got

You will get

@docusaurus/core@2.2.0
  └─┬ update-notifier@5.1.0
    └─┬ latest-version@5.1.0
      └─┬ package-json@6.5.0
        └── got@9.6.0

Here, got@9.6.0 is a vulnerable version.

Expected behavior

@docusaurus/core should use at least update-notifier@6.0.1 which is having non vulnerable got

Actual behavior

@docusaurus/core is using update-notifier@5.1.0 which is having vulnerable version of got@9.6.0

Your environment

• Docusaurus version used: 2.2.0
• Environment name and version (e.g. Chrome 106.0.5249.119, Node.js 16.17.0):
• Operating system and version (e.g. Mac OS Monterey 12.5.1):

Self-service

• I'd be willing to fix this bug myself.

[slorber]

Thanks for reporting

After taking a look, it's unlikely to cause any security trouble in Docusaurus, but we'll upgrade to v6.0 someday (ESM)

See also

• yeoman/update-notifier@9183541
• Disable redirects to UNIX sockets sindresorhus/got#2047

We could as well do like nodemon and start using a simpler/lighter lib, see remy/nodemon#2033

[whoisclebs]

Just an update for those who are a little bothered by the vulnerability alert like me. You can overwrite in your package.json the dependencies that are vulnerable, for example:

 "overrides":{ 
   "trim": "^0.0.3", 
   "got": "^11.8.5" 
 }

https://github.com/clebsonf/ld.health/blob/1e9831fc73ce1696eaeff88adc3ed05262911b63/docs/package.json#L43-L46

[tconbeer]

With yarn, it's "resolutions" instead of "overrides". Otherwise @clebsonf's workaround works great.