Dependencies have security vulnerabilities

[hungrypipo]

For @salesforce/cli even the latest 2.34 version

Just one example, the ip module used 2.0.0 has a vulnerability that can be fixed by a higher version

https://security.snyk.io/vuln/SNYK-JS-IP-6240864

From npm-shrinkwrap.json:

"node_modules/npm/node_modules/ip": {
"version": "2.0.0",
"inBundle": true,
"license": "MIT"
},

The other one that has a fix
https://security.snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-6147607

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[github-actions]

Hello @hungrypipo 👋 It looks like you didn't include the full Salesforce CLI version information in your issue.
Please provide the output of version --verbose --json for the CLI you're using (sf or sfdx).

A few more things to check:

• Make sure you've provided detailed steps to reproduce your issue.
  • A repository that clearly demonstrates the bug is ideal.
• Make sure you've installed the latest version of Salesforce CLI. (docs)
  • Better yet, try the rc or nightly versions. (docs)
• Try running the doctor command to diagnose common issues.
• Search GitHub for existing related issues.

Thank you!

[shetzel]

The many repos involved with building the Salesforce CLI have dependabot running weekly to keep everything as up to date as possible. The ip module you referenced is currently at 2.0.0 and there is a recent patch release (2.0.1). This dependency comes from a nested dep within @oclif/plugin-plugins so it would need to be bumped there and then the version of plugin-plugins bumped within the CLI. I don't see serialize-javascript in use at all by the CLI. But also, just because snyk reports a vulnerability doesn't mean it's a bug or vulnerability in a CLI environment (i.e., running locally on a machine). How the library is being used is an important factor that tools like snyk don't consider. Regardless, I'll look at the dependencies of @oclif/plugin-plugins but unless there's a bug involved with the CLI this is low priority and should eventually be handled by our dependabot update process.

[shetzel]

Will eventually be fixed with oclif/plugin-plugins#821