forcedotcom/lwc-dev-server-feedback

a vulnerability CVE-2020-28469 is introduced in @salesforce/lwc-dev-server

Opened this issue · 2 comments

ayaka-kms commented

Hi, a vulnerability CVE-2020-28469 is introduced in @salesforce/lwc-dev-server via:
● @salesforce/lwc-dev-server@2.10.0 ➔ cpx@1.5.0 ➔ chokidar@1.7.0 ➔ glob-parent@2.0.0

However, cpx is a legacy package, which has not been maintained for about 5 years.
Is it possible to migrate cpx to other package to remediate this vulnerability?

I noticed several migration records in other js repo for cpx:

  1. in commitizen, version 2.10.1 ➔ 3.0.0, remove cpx via commit
  2. in @s-ui/studio, version 10.12.0 ➔ 10.13.0, migrate cpx to copyfiles via commit
  3. in taninsam, migrate from cpx to cpx2 via commit

Are there any efforts planned that would remediate this vulnerability or migrate cpx?

Thanks
; )

randi274 commented

@smaddox-sf is this something we should be considering for our backlog?

stale commented

This issue has been automatically marked as type:bug-p3 because it has not had recent activity.