Skip to content

Fix security vulnerability by upgrading json-schema npm package #2

@jdulin-datto

Description

@jdulin-datto

Describe the bug
The json-schema npm dependency in package.json is outdated and vulnerable to attacks. Updating to version >=0.4.0 should fix the problem.

To Reproduce
Steps to reproduce the behavior:

  1. Run npm audit
  2. Find the following:
json-schema  <0.4.0
Severity: moderate
json-schema is vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-896r-f27r-55mw
No fix available
node_modules/@xops.net/json-schema-to-react-tree/node_modules/json-schema
  @xops.net/json-schema-to-react-tree  *
  Depends on vulnerable versions of json-schema
  node_modules/@xops.net/json-schema-to-react-tree

Expected behavior
Running npm audit should not include any warnings about the json-schema package

Additional context
See GHSA-896r-f27r-55mw to read about the vuln.
This should be as easy as running npm install json-schema@0.4.0 to fix.
This will also fix the same vulnerability that exists in https://github.com/open-rpc/docs-react due to this package being a dependency.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions