Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: security upgrade apollo-server-express from 2.19.0 to 3.0.0 #8068

Closed

Conversation

snyk-bot
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-JS-APOLLOSERVERCORE-2928764
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: apollo-server-express The new version differs by 250 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Security upgrade apollo-server-express from 2.19.0 to 3.0.0 refactor: security upgrade apollo-server-express from 2.19.0 to 3.0.0 Jun 22, 2022
@Moumouls
Copy link
Member

@mtrezza before Yoga i checked the upgrade from 2.X to 3.X for apollo, the interface used by parse server is not available in 3.X and could introduce a breaking change on Parse 4.X.

On my side, I'll not be able to push the changes needed to fix this security issue.

@mtrezza mtrezza changed the title refactor: security upgrade apollo-server-express from 2.19.0 to 3.0.0 fix: security upgrade apollo-server-express from 2.19.0 to 3.0.0 Jun 26, 2022
@parse-github-assistant
Copy link

Thanks for opening this pull request!

  • ❌ Please edit your post and use the provided template when creating a new pull request. This helps everyone to understand your post better and asks for essential information to quicker review the pull request.

@mtrezza
Copy link
Member

mtrezza commented Jun 26, 2022

OK, we keep this as an open vulnerability of the LTS version; if there is demand to fix this; someone can pick it up; otherwise they should upgrade to Parse Server 5. Not sure what's the best way to communicate that to LTS users though.

@Moumouls
Copy link
Member

Not sure what's the best way to communicate that to LTS users though.

A warning message at startup could be added using the deprecation system?

@mtrezza
Copy link
Member

mtrezza commented Jun 27, 2022

4.x doesn't have that; adding it to the README is probably the easiest and most noticeable; addressed in #8077

@mtrezza
Copy link
Member

mtrezza commented Jul 25, 2022

Closing as wont-fix; if anyone wants to work on fixing this open vulnerability of Parse Server 4.x (LTS) we can re-open.

@mtrezza mtrezza closed this Jul 25, 2022
@mtrezza mtrezza deleted the snyk-fix-4581c39f1920012e8cd9ce784667ade6 branch May 20, 2023 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants