Reconsider supporting usdws version 2.

[lukemarkwordtlibertyits]

Is your feature request related to a problem? Please describe.

From my understanding usdws 2 is not currently supported. It seems like in issue 504 it was determined to be unnecessary. The issue that I have found is that the latest versions of usdws 1 (v1.6.13) still has some security vulnerabilities.

Describe the solution you'd like

Support usdws version 2.

Describe alternatives you've considered

I cannot think of a way to get rid of vulnerabilities in usdws 1 without forcing them. I guess I could also create a ticket in the usdws repository to take care of these vulnerabilities, but they may still be in there for a reason (i.e. a breaking change).

Additional context

Currently I am getting errors when trying to run usdws 2 with the most recent @department-of-veterans-affairs/formation version.

[lukemarkwordtlibertyits]

I will be OOO next week 5-24-21 - 5-28-21 so @crolarlibertyva will be the POC for this issue until I get back.

[cvalarida]

Hey, @lukemarkwordtlibertyits @crolarlibertyva, thanks for submitting the issue. I'd like to get a little more context.

• Where are you finding the list of vulnerabilities?
• Where are you using formation?
  • In vets-website, we've addressed all the security vulnerabilities with resolutions
    • Technically, there's still one outstanding low risk vulnerability I see, but according to the advisory, it requires the attacker to be in control of the options passed to the library, which isn't the case for vets-website to my knowledge

That said, we've gotten this request a few times now, so we'll plan for a spike to try using USWDS 2.0 in Formation when we can. The end goal there will be to either plan the work to make the migration or write a decision document explaining in detail why we're staying on v1.

[lukemarkwordtlibertyits]

Sorry for the delay. Just got back from PTO. We use formation in lighthouse-saml-proxy. Currently, we are also forcing the resolution, but do not believe this is a good practice for the long term so we are exploring our options. I have also sent a request to USWDS to see if the can create a 1.x that addresses this vulnerability.

[cvalarida]

Ahhh, that's good to know, thanks! I agree, I'd rather resolve the issue at the source. As far as the upgrade to USWDS 2.x goes, though, it's a matter of effort vs value. The design system team is very small (just two engineers), so we have to be really careful to spend our effort on the work with the greatest impact. That spike will determine the effort and value so we can prioritize appropriately. (We'll be sure to factor resolving security vulnerabilities into the value. 👍 )

Thanks for filing this issue!