Skip to content

minimatch security vulnerability in CLI - only way to fix it is to delete cli folder contents #1698

Closed
@diomedtmc

Description

@diomedtmc

protobuf.js version: 6.11.2

Expected Behavior: Protobuf.js passes all security scans and vulnerability checks.
Actual Behavior: It fails our scans repeatedly because of a known minimatch 3.0.4 (or lower) security vulnerability.

Additional notes: Because of the way the cli is packaged (lock file + node_modules folder), we are unable to cleanse the problem through conventional means. (npm overrides or yarn resolutions for instance). We do not use the CLI for production runtimes, but because of the way protobufjs is packaged, the cli and its vulnerability end up in the production image.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions