Security Vulnerabilities in @toolpad/core

[PetarDimitrovZH]

At this moment there 6 high severity vulnerabilities in @toolpad/core package. Is there any plan to fix those?

Here is the output of npm audit:

Search keywords:

[Janpot]

upstream issue vercel/title#85. looks like it's fixed in their latest version.

[PetarDimitrovZH]

I am now with @toolpad/core: 0.10.0, the latest version in npm. In which release you are planning to publish the fixes?

[Janpot]

yes it will be part of next version. Just to note that the offending cross-spawn dependency is not being called. There is no real vulnerability here other than on paper.

[PetarDimitrovZH]

Ok, thanks a lot!

[github-actions]

This issue has been closed. If you have a similar problem but not exactly the same, please open a new issue.
Now, if you have additional information related to this issue or things that could help future readers, feel free to leave a comment.

Note

@Petar-Dimitrov-AXA How did we do? Your experience with our support team matters to us. If you have a moment, please share your thoughts in this short Support Satisfaction survey.

[Janpot]

we can leave this open for tracking purposes

[github-actions]

This issue has been closed. If you have a similar problem but not exactly the same, please open a new issue.
Now, if you have additional information related to this issue or things that could help future readers, feel free to leave a comment.

Note

@Petar-Dimitrov-AXA How did we do? Your experience with our support team matters to us. If you have a moment, please share your thoughts in this short Support Satisfaction survey.

[rolandjitsu]

@Janpot would it make sense to relax the dependencies so that patches are picked up on? E.g. in

toolpad/packages/toolpad-utils/package.json

Line 64 in b9315b6

"title": "4.0.1",

one could use:

"title": "~4.0.1",

[Janpot]

yes, I wouldn't mind to even widen it to ^4.0.1. are you interested in opening a PR for this?

[rolandjitsu]

yes, I wouldn't mind to even widen it to ^4.0.1. are you interested in opening a PR for this?

Sure, I can.