Vulnerable Library Dependency

[jasonchavez520]

Hello, I performed a Whitesource scan of the following:
@docusaurus/preset-classic (2.0.0-alpha.70)

I noticed that you are utilizing trim-0.0.1 in the following dependency hierarchy:

preset-classic-2.0.0-alpha.70.tgz

• theme-classic-2.0.0-alpha.70.tgz
  • mdx-1.6.22.tgz
    • remark-parse-8.0.3.tgz
      • ❌ trim-0.0.1.tgz (Vulnerable Library)

Could trim be updated to its most up-to-date version? trim-1.1.0? Or is this something out of the purview and something I should manage on my own. Thank you.

[RDIL]

It looks like mdx hasn't updated remark if I'm not mistaken, so it may just be that we are waiting on downstream.

Either way, remark-parse is only used in development, so you most likely won't have the security issue in production.

[slorber]

@jasonchavez520 we will upgrade to MDX 2 sooner or later, I'm in touch with Titus about this upgrade.

[jasonchavez520]

Is there an estimated timeline as to when this would occur? It can be a ballpark estimate...I'm just trying to gauge my options. Thanks!

[slorber]

@jasonchavez520 maybe in the next 2 months.

As far as I understand, the issue is https://snyk.io/vuln/SNYK-JS-TRIM-1017038
Why is this important to you, are you feeling you are vulnerable?

I don't think you have much reason to worry about.
Docusaurus is not a runtime server, does not really accept user inputs to be trimmed that are not committed as content to your repository, and no hacker would benefit much from making your CI build fail due to a DOS attack imho.

[jasonchavez520]

Not feeling particularly vulnerable. It's just an enterprise requirement has been rolled out to remediate nested libraries that are vulnerable.
I have to either remediate the finding manually and perform regression test on my own or provide a reason why this can wait. Having a ballpark date that this would be updated 2-3 months in the future allows me to submit for an enterprise exception.

[slorber]

@jasonchavez520 you can probably force upgrade to 0.0.3 by using the yarn resolutions: https://classic.yarnpkg.com/en/docs/selective-version-resolutions/#toc-how-to-use-it