Bump version for crypto-js to >= 4.0.0 (security issue)

[c-goetz]

Bug Report

Pdfkit depends on crypto-js with the version qualifier "crypto-js": "^3.1.9-1",. This version is vulnerable to brix/crypto-js#254

Please bump the version to >= 4.0.0 and maybe remove the "^" from version. Crypto-js does not seem to use semantic versioning correctly.

Description of the problem

From reading the vulnerability report it may seem that updating to >= 3.2.1 is sufficient. But the fix
was later rolled back in 3.3.0 (see comment at end of brix/crypto-js#256)

Warning: this may break things on older browsers.

Thanks for your time and work on this library. Much appreciated.

Code sample

Your environment

• pdfkit version:
• Node version:
• Browser version (if applicable):
• Operating System:

[alliedgorn]

I'm having this problem with my company's vulnerability scanner. Is there anything I can help to get this through?

[JavaZava]

@c-goetz I am dealing with this issue, but we were able to side step it by regenerating the package-lock.json file

As you correctly state, this package requires "crypto-js": "^3.1.9-1" which is affected by a big vulnerability. However, it was patched in version 3.2.1.

By recreating the package-lock.json file, npm should download the latest compatible library (minor update) which is 3.3.0 at the time of writing.

This is what we did on our side, and Snyk (the service we use to review these issues) stopped complaining about this vulnerability.

[blikblum]

I updated to 3.3 than realized that is same as 3.1.

Upgrading to 4.0 seems straightforward. The drop of IE10 should not be a problem, but will affect also react native (which i don't know if currently works).

[c-goetz]

@JavaZava, as @blikblum mentioned 3.3.0 is basically 3.1.9-1 and thus also vulnerable. I just reported that to Snyk, so your vulnerability scanner should also pick it up soon.
Our current solution to this problem is to exclude the transitive dependency on crypto-js and patch out every usage of it from our direct dependencies.
This seems more feasible than my original plan to report the vulnerability along our dependency chain.

[liborm85]

https://app.snyk.io/vuln/SNYK-JS-CRYPTOJS-548472 say:

Remediation
Upgrade crypto-js to version 4.0.0, 3.2.1 or higher.

Because pdfkit 0.12.1 uses crypto-js version 3.3.0 it should be safe version. Is not possible upgrade to 4.0.0, because pdfkit works in React native.

In https://github.com/brix/crypto-js changelog is critical bug only in version 3.2.0 others are without vulnerable.

[blikblum]

Done in 0.12.3