serverless-operations/serverless-step-functions

Vulnerability for versions < 10.0.7 of JSONPath

Closed this issue · 2 comments

jeremy-brooks commented

There is a vulnerability in the transitive dependency JSONPath

Description

The latest possible version of JSONPath that can be installed is 7.2.0 because of the following conflicting dependencies:

  • serverless-step-functions@3.21.2 requires jsonpath-plus@^7.0.0 via a transitive dependency on asl-path-validator@0.13.0
  • serverless-step-functions@3.21.2 requires jsonpath-plus@^7.2.0 via a transitive dependency on asl-validator@3.8.3

The earliest fixed version of JSONPath is 10.0.7.

The vulnerability was first published in November 2024.

See CVE-2024-21534 for more details.

lym953 commented

Bump this. Since #640 is merged, when is it going to be released?

  • 👍1
zirkelc commented

Available in the latest release

  • 👍1