Chokidar: Snyk Reporting a Vulnerability in glob-parent Dependency

[drsavant-pub]

Snyk is reporting a vulnerability in glob-parent (one of the dependencies in ckokidar v3.5.1) Link

I've notified glob-parent as have six-others. They have no intention of fixing this vulnerability Link1 Link2

Perhaps Snyk has a patch. Look for the button: "Fix it in your project with Snyk!"

[paulmillr]

I support glob-parent maintainers decision. If it is a real vuln, they should report it via NPM.

[drsavant-pub]

Well, that's your choice, but if this continues developers will eventually stop including chokidar in their dependencies.

[paulmillr]

snyk is downloaded 379k times per week (https://www.npmjs.com/package/snyk). Chokidar is 29 million (https://www.npmjs.com/package/chokidar). I don't consider it relevant.

Again, if it was REAL vulnerability and not some spammy shit, i'd totally fix it.

[drsavant-pub]

Safety in numbers is not a logical position. If there is a vulnerability it should be resolved. Are we bureaucrats or computer scientists? I get what you're saying, but as developers become increasingly aware of the need for checking vulnerabilities they must turn to snyk and others to resolve their concerns (these issues will not go away, they will only receive greater attention) and if one engine (like snyk) finds a vulnerability then the others will too. It's a snowball effect.

[paulmillr]

Because this is not "vulnerability". If it was, it would get reported through NPM. Instead of arguing with me, make a pull request to glob-parent. I support @phated 's judgement.

[phated]

@paulmillr Thanks, I agree. Snyk is a cancer on the maintainer community. @Trott put in the work to investigate and take it across the finish line. A new glob-parent with his patch was just released today.

[drsavant-pub]

@paulmillr I'm not arguing, I'm agreeing with what you wrote here: Link

Every dependency is a potential security vulnerability
There is a sad trend in JS community to create packages that consume lots of dependencies. Django, a huge web-framework written in Python, uses only three deps right now. As a comparison, nest.js uses 41 dependency!

I want to emphasize that every dependency is a potential security vulnerability. Consider three cases:

Reputable developer giving project rights to a rogue developer in a good faith (happened before).
Reputable developer getting hacked and having a bad package published.
Rogue developer creating new project, waiting for it to become popular and pushing a bad version after that (happened before).

And from my perspective there are two more cases to consider:
Newly discovered vulnerabilities that remain unpatched
Newly patched (previously vulnerable) dependencies that are not updated in the repo

Now that glob-parent is patched will you be updating chokidar with the new version of glob-parent?

[paulmillr]

there is no need - check package.json

[phated]

@paulmillr it's absolute madness that most node devs these days don't understand how semver in their dependencies works 🙃