sendgrid/sendgrid-nodejs

Please upgrade axios in the @sendgrid/client since it has security issue

Closed this issue · 8 comments

RezaRahmati commented

Issue Summary

@sendgrid/client has dependecy to axios@0.21.4, and that version of axios has a high severity security issue (as per whitesource) Please see below image, and seems issue is resolved on any version higher than 0.21.4.

image

Technical details:

  • sendgrid-client version: 7.6.0
  • node version: 16
eshanholtz commented

This issue has been added to our internal backlog to be prioritized. Pull requests and +1s on the issue summary will help it move up the backlog.

snuffykl commented

Hi @eshanholtz any update on upgrading axios@0.21.4 to the latest to fix security vulnerability in @sendgrid/client ?

prashant93 commented

Hi @eshanholtz any update on this, If need any detail or help let me know? Due to this issue our production release on hold.
This has been raised since November.

villesau commented

@eshanholtz it's. high severity issue. Should help with prioritization.

This is the issue: GHSA-74fj-2j2h-c42q

This is how it ends up to the sendgrid libraries:

follow-redirects@1.14.4
node_modules/follow-redirects
  follow-redirects@"^1.14.0" from axios@0.21.4
  node_modules/axios
    axios@"^0.21.4" from @sendgrid/client@7.6.0
    node_modules/@sendgrid/client
      @sendgrid/client@"^7.5.0" from the root project
      @sendgrid/client@"^7.6.0" from @sendgrid/mail@7.6.0
      node_modules/@sendgrid/mail
        @sendgrid/mail@"^7.6.0" from the root project
RezaRahmati commented

if you are using npm >=8.3.0, you can add "overrides": {} section to your package.json and force another version of axios, until this is fixed, please make sure you will do regression in case there was a breaking change

https://docs.npmjs.com/cli/v8/configuring-npm/package-json#overrides

Sujay-shetty commented

@RezaRahmati tried to use overrides property of package.json to override axios version to 0.25.0 but couldn't succeed.
sample 1 :

{
    "dependencies": {
        "@sendgrid/mail": "^7.6.0",
        "bluebird": "^3.5.1",
    }
    "overrides": {
         "axios": "0.25.0"
    }
}

sample 2 :

{
    "dependencies": {
        "@sendgrid/mail": "^7.6.0",
        "bluebird": "^3.5.1",
    }
    "overrides": {
         "@sendgrid/mail": {
             "@sendgrid/client": {
                  "axios": "0.25.0"
              }
         }
    }
}

Could you please share code change for the same?

Node : 14.19.0
npm : 6.14.16

RezaRahmati commented

@RezaRahmati tried to use overrides property of package.json to override axios version to 0.25.0 but couldn't succeed. sample 1 :

{
    "dependencies": {
        "@sendgrid/mail": "^7.6.0",
        "bluebird": "^3.5.1",
    }
    "overrides": {
         "axios": "0.25.0"
    }
}

sample 2 :

{
    "dependencies": {
        "@sendgrid/mail": "^7.6.0",
        "bluebird": "^3.5.1",
    }
    "overrides": {
         "@sendgrid/mail": {
             "@sendgrid/client": {
                  "axios": "0.25.0"
              }
         }
    }
}

Could you please share code change for the same?

Node : 14.19.0 npm : 6.14.16

please read my answer again, it needs node >= 8.3.0