[Bug]: Vulnerabilities in @modern-js/node-bundle-require due to the old esbuild dependency
#6993
Comments
|
Thank you for raising this issue and providing detailed information about the vulnerabilities in [email protected]. We understand the importance of keeping dependencies up-to-date to address security concerns. However, there is currently a constraint that prevents us from upgrading esbuild to the latest version. Node.js 16 Compatibility Next Steps |
|
Using Node.js 16 is insecure by itself, it's End-of-life from 2023 (link). I think the default should be to use secure versions of dependencies (esbuild 0.25.1+), and if people want/need to use insecure technologies (EOL Node.js), then they can override eslint's version back to whatever <0.22.0 version as they wish (using package.json's overrides/resolutions section), no? TL;DR I think out-of-the-box security is more important than out-of-the-box EOL Node.js support. |
|
I've been able to fix the security issue by overriding esbuild in package.json Hoping that doesn't break anything |
|
We will officially end support for Node.js 16 on June 30, 2025, at which time we will upgrade the esbuild dependency to the latest version to address all the security vulnerabilities you've reported. In the meantime, if you need to address these security issues immediately, you can use the temporary solution mentioned in the comments by overriding the esbuild version in your We understand the importance of security concerns and appreciate the community's attention to the project's security. We are actively working on reducing our dependencies on these packages while ensuring a smooth transition to more secure solutions. Thank you for your understanding and support. |
Version
npmPackages: @modern-js/app-tools: 2.66.0 => 2.66.0 @modern-js/runtime: 2.66.0 => 2.66.0 @modern-js/tsconfig: 2.66.0 => 2.66.0Details
@modern-js/node-bundle-requirehas a dependencyesbuildversion 0.17.19 (https://github.com/web-infra-dev/modern.js/blob/main/packages/toolkit/node-bundle-require/package.json#L56) which is many years old and has multiple security issues, one of them Critical. One of them is a vulnerability of theesbuildnode package itself, while others are caused by its go binaries published under@esbuild/*namespace.If the version is bumped to at least 0.25.1 then all of them will be fixed.
The vulnerabilities for the binaries come from the version of Go being used to build those binaries. Esbuild announces Go versions in use in their releases, e.g. "Update Go from 1.23.5 to 1.23.7" for release 0.25.1.
Output of a Trivy scan regarding esbuild binaries with version 0.17.19:
Reproduce link
https://github.com/web-infra-dev/modern.js/blob/main/packages/toolkit/node-bundle-require/package.json#L56
Reproduce Steps
mkdir myapp && cd myapp && npx @modern-js/create@latest(choose TS and npm)npm auditThe text was updated successfully, but these errors were encountered: