Cypress: Bump Lodash to v4.17.17+ to fix NPM advisory

Created on 8 Jul 2020 · 4Comments · Source: cypress-io/cypress

Current behavior:

Lodash v4.17.17 was released, fixing https://npmjs.com/advisories/1523.

Cypress is using "fixed" version (v4.17.15) as dependency, causing npm audit to fail:

                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.17                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cypress [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cypress > lodash                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1523                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 1476 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Desired behavior:

Make sure npm audit fix is able to bump Lodash to the updated version.

Versions

Cypress 4.10 and lower.

┆Issue is synchronized with this Jira Bug by Unito

existing workaround internal-priority dependencies

Source

khitrenovich

👍5

Most helpful comment

We prefer locking dependencies so we know exactly what versions our users are using and ensure it works on these exact versions before publishing. We've run into issues in the past without locking. I can bring this up with the team to see if we should revisit this strategy.

Unless you’re hosting Cypress on a server and accepting unsanitized input from outside users - most security vulnerabilities will not affect you. We think this is an extremely unlikely use case.

We understand that a lot of people have policies about needing to pass npm audit for their build regardless. I've opened a PR here to address this https://github.com/cypress-io/cypress/pull/7926

You could use https://github.com/rogeriochaves/npm-force-resolutions to work around this in the meantime.

jennifer-shehane on 9 Jul 2020

👍4

All 4 comments

All dependencies are fixed, not using semver at all (~ or ^). Kinda strange if you ask me :-)

millette on 9 Jul 2020

Unless you’re hosting Cypress on a server and accepting unsanitized input from outside users - most security vulnerabilities will not affect you. We think this is an extremely unlikely use case.

We understand that a lot of people have policies about needing to pass npm audit for their build regardless. I've opened a PR here to address this https://github.com/cypress-io/cypress/pull/7926

You could use https://github.com/rogeriochaves/npm-force-resolutions to work around this in the meantime.

jennifer-shehane on 9 Jul 2020

👍4

The code for this is done in cypress-io/cypress#7954, but has yet to be released.
We'll update this issue and reference the changelog when it's released.