Closed
Description
protobuf.js version: 6.11.2
Expected Behavior: Protobuf.js passes all security scans and vulnerability checks.
Actual Behavior: It fails our scans repeatedly because of a known minimatch 3.0.4 (or lower) security vulnerability.
Additional notes: Because of the way the cli is packaged (lock file + node_modules folder), we are unable to cleanse the problem through conventional means. (npm overrides or yarn resolutions for instance). We do not use the CLI for production runtimes, but because of the way protobufjs is packaged, the cli and its vulnerability end up in the production image.
Metadata
Metadata
Assignees
Labels
No labels