-
Notifications
You must be signed in to change notification settings - Fork 45
Open
Description
Context
The @sentry/browser package has a vulnerability (link), and this package (as well as @stoplight/markdown-viewer, which doesn't seem to have a public repository) depends on it:
$ yarn why -R @sentry/browser
...
├─ @stoplight/json-schema-viewer@npm:4.16.4 [e8750] (via npm:^4.16.4 [e8750])
│ └─ @stoplight/react-error-boundary@npm:2.0.0 [f6b81] (via npm:^2.0.0 [f6b81])
│ └─ @sentry/react@npm:6.19.7 [3e6c1] (via npm:^6.13.2 [3e6c1])
│ └─ @sentry/browser@npm:6.19.7 (via npm:6.19.7)
└─ @stoplight/markdown-viewer@npm:5.7.1 [e8750] (via npm:^5.7.1 [e8750])
└─ @stoplight/react-error-boundary@npm:2.0.0 [f6b81] (via npm:^2.0.0 [f6b81])Current Behavior
@stoplight/json-schema-viewer and @stoplight/markdown-viewer depend on a vulnerable version of @sentry/browser
Expected Behavior
@stoplight/json-schema-viewer and @stoplight/markdown-viewer depend on a non-vulnerable version of @sentry/browser, or they don't depend on @sentry/browser, at all
Possible Solution(s)
Upgrade @stoplight/react-error-boundary to v3 in both @stoplight/json-schema-viewer and @stoplight/markdown-viewer
Metadata
Metadata
Assignees
Labels
No labels