Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update tough-cookie indirect dependency to version >=4.1.3 #1381

Closed
tiagodarosa opened this issue Nov 1, 2023 · 4 comments
Closed

Update tough-cookie indirect dependency to version >=4.1.3 #1381

tiagodarosa opened this issue Nov 1, 2023 · 4 comments

Comments

@tiagodarosa
Copy link

Describe the bug
The tough-cookie indirect dependency has a security vulnerability. Please check here https://security.snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873 and here salesforce/tough-cookie#282 and update to a version >= 4.1.3. This may require removing request as it is already deprecated request/request#3142.

** Client Version **
0.19.0

@professorabhay
Copy link

Hey @tiagodarosa, Can you share more details about that ?

@mstruebing
Copy link
Member

mstruebing commented Nov 2, 2023

We are currently in the process of removing request as a dependency but it's not yet ready to release.
We have a branch release-1.x which contains the current code. There is as well a 1.0.0-rc3 release on npm available.
This may contain bugs but you could try using this version instead.
I just checked and this dependency is not available in the 1.x branch.

In order to see the progress of the 1.x branch you can have a look here: https://github.com/kubernetes-client/javascript/blob/release-1.x/FETCH_MIGRATION.md or here #754 which both should contain the latest information.

I'll close this as a duplicate of #754 as we would need to remove request for this.

What you could try is to manually override the dependency in request but I would assume there are some incompatibilities between these version as these are 2 major versions difference.

@brendandburns
Copy link
Contributor

brendandburns commented Nov 2, 2023

The path to deprecate the request library is documented here: #414

I'm going to close this issue in favor of that issue.

Updated: Oops, my github page was stale and I didn't see @mstruebing comments above which gives much more details :)

@tiagodarosa
Copy link
Author

Thank you @brendandburns @mstruebing @professorabhay for your attention! I'll try the 1.0.0rc version!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants