Mongodb-memory-server: found 1 high severity vulnerability: decompress

[jamer007]

Versions

• NodeJS: 12.13.1
• mongodb-memory-server-*: 6.2.4
• mongodb: 6.2.2
• system: MacOS

package: mongo-memory-server-core

What is the Problem?

Decompress package is flagged as high severity vulnerability

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Write                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ decompress                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mongodb-memory-server [dev]                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mongodb-memory-server > mongodb-memory-server-core >         │
│               │ decompress                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1217                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[hasezoey]

decompress didnt got an update since 2017, and i only found one alternative, tar-stream

@nodkz should we switch to that instead of decompress?

[nodkz]

Sure!!!

If somebody can send PR it will be nice! I'm in business trip right now and can do it myself only in the next week!

[hasezoey]

@nodkz i will probably try it, after the logging change got merged to better debug it (#270)

[carnun]

Any chance to get the PR merged in? I see there are some conflict that are still unresolved.

[nodkz]

Fixed in 6.4.1
Thanks to @jeroen-plug