You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Problem
Jsdoc-to-markdown currently is using the latest version 6.2.0 of jsdoc-parse, which utilizes lodash.pick version 4.4.0. Lodash.pick has been flagged for a security issue as documented here. This poses a potential risk to the security of the project.
Furthermore, according to the lodash documentation available here, the use of lodash.pick is discouraged, and it is mentioned that it will be removed in version 5.
node_modules/lodash.pick
jsdoc-parse >=2.0.2
Depends on vulnerable versions of lodash.pick
node_modules/jsdoc-to-markdown/node_modules/jsdoc-parse
jsdoc-to-markdown 0.6.0 - 0.6.4 || >=2.0.0-alpha.0
Depends on vulnerable versions of jsdoc-parse
node_modules/jsdoc-to-markdown
Requested Action
Is there any plan to address this issue in a future release of jsdoc-to-markdown? If so, could you provide an estimated timeline for the fix?
In the interim, are there any recommended measures or workarounds to mitigate the security risk associated with the current use of lodash.pick in jsdoc-parse?
PR merged and released in jsdoc-to-markdown v8.0.1 - thanks for letting me know.. These security warnings are completely irrelevant for offline, occassional-use command line dev tools but hey ho..
Problem
Jsdoc-to-markdown currently is using the latest version 6.2.0 of jsdoc-parse, which utilizes lodash.pick version 4.4.0. Lodash.pick has been flagged for a security issue as documented here. This poses a potential risk to the security of the project.
Furthermore, according to the lodash documentation available here, the use of lodash.pick is discouraged, and it is mentioned that it will be removed in version 5.
Requested Action
Is there any plan to address this issue in a future release of jsdoc-to-markdown? If so, could you provide an estimated timeline for the fix?
In the interim, are there any recommended measures or workarounds to mitigate the security risk associated with the current use of lodash.pick in jsdoc-parse?
Environment
jsdoc-to-markdown: 8.0.0
jsdoc-parse version: 6.2.0
The text was updated successfully, but these errors were encountered: