[rush] CVE-2024-21534 (jsonpath-plus) is still unresolved

[npetruzzelli]

Summary

#4966 and #4981 attempted to resolve this.

But the problem is still reported by security scans.

Repro steps

1. Create a new repository
2. npm install @microsoft/rush@5.141.0
3. Run a security scan

Expected result:
No Vulnerabilities

Actual result:
Vulnerabilities related to jsonpath-plus (CVE-2024-21534) and ansi-align@3.0.1 (CVE-2022-38900)

The ansi-align issue isn't clear. I don't yet know if it is related to the dependency on string-width, which is by the same author as those indicated in the CVE. It also looks like ansi-align hasn't been updated in 3 years.

Details

GitHub's own advisory is out of date, marking this as resolved by version 10.0.7
GHSA-pppg-cpfq-h7wr

If you follow the link to NVD, you can see that the reporter (Snyk) still considers 10.1.0 as vulnerable.
https://nvd.nist.gov/vuln/detail/CVE-2024-21534

It references an issue that declares 10.2.0 as safe.
JSONPath-Plus/JSONPath#226
https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884

Standard questions

Please answer these questions to help us investigate your issue more quickly:

Question	Answer
@microsoft/rush globally installed version?	Not Applicable
rushVersion from rush.json?	Not Applicable
useWorkspaces from rush.json?	Not Applicable
Operating system?	Windows
Would you consider contributing a PR?	Yes / if time allows
Node.js version (node -v)?	Not Applicable

[npetruzzelli]

I still haven't figured out what is going on with ansi-align (a downstream dependency of rush-lib). I suspect it is a false positive since the CVE is for an unrelated package. I am still waiting to find out what we hear back from our security scan vendor.

Thanks again for the quick update!