Firebase-js-sdk: Audit: Stop minimist dependancy prototype pollution

[mesqueeb]

[REQUIRED] Describe your environment

• Operating System version: macOS 10.15.3
• Browser version: unrelated - it's a dependency problem
• Firebase SDK version: latest version (^7.12.0)
• Firebase Product: all

[REQUIRED] Describe the problem

Steps to reproduce:

npm i firebase@latest

gives these security warnings:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ firebase                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ firebase > @firebase/firestore > grpc > node-pre-gyp >       │
│               │ mkdirp > minimist                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179

see: https://npmjs.com/advisories/1179

[google-oss-bot]

I couldn't figure out how to label this issue, so I've labeled it for a human to triage. Hang tight.

[Feiyang1]

I did a fresh install of firebase and I got [email protected].
Can you try removing node_modules and package-lock.json and do a fresh install to see if it resolves the issue?

[retnikt]

I have tried clearing it, and have [email protected] but still end up with the npm warning. Seems like this is an issue elsewhere.

[maheshkumar2150]

Same problem. Any solution? Safe to use on live server?

[dev-magesstudio]

We are getting the same issue as well, with fresh install of Firebase, tried the removal of nodes+package-lock.json and it's still persisting

[google-oss-bot]

Hey @mesqueeb. We need more information to resolve this issue but there hasn't been an update in 5 weekdays. I'm marking the issue as stale and if there are no new updates in the next 5 days I will close it automatically.

If you have more information that will help us get to the bottom of this, just add a comment!

[mesqueeb]

Hi @google-oss-bot 👋
What info do you need more?

[stevecastaneda]

Same issue here.

• Firebase 7.13.2
  3 low vulnerabilities all regarding minimist

Tried to clear my package-lock.json and delete node_modules folder + npm install on project folder but that did not fix the issue.

[tvvignesh]

Same on my end as well. Showing 3 vulnerabilities in minimist. Screenshot below.

[Polatouche]

├─┬ [email protected]
│ ├─┬ @firebase/[email protected]
│ │ ├─┬ [email protected]
│ │ │ ├─┬ [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ └── [email protected]
│ │ │ │ ├─┬ [email protected]
│ │ │ │ │ ├── [email protected]

firebase 7.13 is using old versions of minimist .
[email protected] fix that

[Feiyang1]

Thanks @Polatouche! Yes, we replaced grpc with grpc-js, so minimist is not a dependency of firestore any more.