Security audit issue in v13.0.0 (@babel/traverse)

[DmitryMarkov]

Kudos @mosch and @dan-lee !
We still use this lib in Cockpit and App ;)

Last week security check thows an issue with one of the deps

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Babel vulnerable to arbitrary code execution when compiling  │
│               │ specifically crafted malicious code                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ @babel/traverse                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=7.23.2                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-avatar-editor                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-avatar-editor > @babel/plugin-transform-runtime >      │
│               │ babel-plugin-polyfill-corejs2 >                              │
│               │ @babel/helper-define-polyfill-provider > @babel/traverse     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094379                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

As I see, you already refactored the lib to not use this dependency, so just want to ask, are you planning to release new stuff any time soon?

[mosch]

Hey @DmitryMarkov thank you for bringing this up. I'd be nice to get feedback on the beta, but I think we can release it by now. Let me see...

[mosch]

@DmitryMarkov you can try out the 14.0.0-beta.2 and let me know if it works like expected.

[DmitryMarkov]

@mosch I tried, but at least one functionality isn't working: touch and scroll image inside the area and I see error in console

and most critical, it saves black trtansparent image after save

🤷‍♂️

[bpinheiroms]

@DmitryMarkov You can keep with the version 13.
You just need to put this in your package.json: (in my case I'm using PNPM)

"pnpm": {
    "overrides": {
      "@babel/traverse@<7.23.2": ">=7.23.2"
    }
  },