Repository navigation
chore(deps): pin patched msal-node and serialize-javascript - #321
Merged
Merged
Conversation
npm audit --audit-level=high fails on GHSA-xcx6-jx8p-x3h5 (@azure/msal-node before 7.1.0, via @azure/identity) and GHSA-m5mm-p8h7-m29v (serialize-javascript before 7.1.3, via mocha). Identity 4.14.0 still declares msal-node ^6, so the override forces 7.1.1. That module still exports the clients identity loads, and identity does not pass the responseMode option removed in msal-node 7. This is the audit failure blocking Dependabot PR #320. Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Pin
@azure/msal-nodeto 7.1.1 andserialize-javascriptto 7.1.4 sonpm audit --audit-level=highpasses.Why
Dependabot PR #320 is blocked on the required
npm auditcheck. That Actions bump does not change npm dependencies. The same audit fails on current main:@azure/msal-nodebefore 7.1.0, reached through@vscode/vsceand@azure/identity. Identity 4.14.0 still depends onmsal-node^6.npm audit fix --forcewould downgrade@vscode/vsce, so this override keeps vsce 4 and forces the patched MSAL release.serialize-javascriptbefore 7.1.3, reached through mocha. The mocha override was still 7.0.5.@azure/identity4.13.3 loads against msal-node 7.1.1. It does not passresponseMode, which msal-node 7 removed from interactive login.Ref #320
Verification
npm audit --audit-level=highreports 0 vulnerabilities@azure/msal-nodeexports load, andrequire("@azure/identity")succeeds on 7.1.1npm run check: 508 unit tests passed, line coverage 93.01%,vsce packagesucceededChecklist
git commit -snpm run checkand it passes