Graphql-code-generator: Security Issue NODE_TLS_REJECT_UNAUTHORIZED is set to 0

[TSiege]

Found a major security concern. This package sets my project's NODE_TLS_REJECT_UNAUTHORIZED to 0 for the entire process thereby disabling SSL. I found this when searching after seeing this security warning from node.

Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.

I've traced it back to this commit... https://github.com/dotansimha/graphql-code-generator/pull/147/commits/8b0bc1ea8408badb845696e35df85c6a84a4563a

[simPod]

Can it be backported to v0.18 pls?

[dotansimha]

@simPod on it now, sorry for the delay.

[dotansimha]

@simPod 0.18.2 is available now.

[simPod]

@dotansimha thanks, contacted NPM about fix for https://www.npmjs.com/advisories/834 (there's no release with fix for v1 AFAIK)

[dotansimha]

Fixed in 1.2.0.

[simPod]

@dotansimha Hi, NPM cannot find the release https://www.npmjs.com/package/graphql-code-generator

[dotansimha]

@simPod we moved to organization libraries after 1.0, graphql-code-generator is now @graphql-codegen/cli and plugins are also moved (for example graphql-codegen-typescript is now @graphql-codegen/typescript.

The 0.18.2 release was only for people who's not migrated yet to 1.0 :)

[simPod]

@dotansimha right, I forgot that! thanks