npm audit failures due to jsonwebtoken

[diracdeltas]

Is this a feature request or a bug?

bug

What is the current behavior?

npm audit in a package that depends on "web-ext": "7.4.0" fails due to vulnerable dependencies:

# npm audit report

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/jsonwebtoken
  sign-addon  *
  Depends on vulnerable versions of jsonwebtoken
  node_modules/sign-addon
    web-ext  >=1.0.0
    Depends on vulnerable versions of sign-addon
    node_modules/web-ext

3 vulnerabilities (2 moderate, 1 high)

[equal-l2]

This is solved on the master of sign-addon (mozilla/sign-addon#1175).
We need a new release of sign-addon to introduce the fix, though.

[diracdeltas]

@equal-l2 thanks. Looks like now there is another one to fix too: GHSA-8gh8-hqwg-xf34

due to dependency on addons-linter which depends on ajv-merge-patch which depends on fast-json-patch

[willdurand]

I am taking a look now.

[willdurand]

New failures caused by two JSON libs:

json5 (https://github.com/advisories/GHSA-9c47-m6qq-7p4h):
  2.2.1, paths: @babel/core>json5, babel-plugin-istanbul>istanbul-lib-instrument>@babel/core>json5
  1.0.1, paths: eslint-plugin-import>tsconfig-paths>json5
fast-json-patch (https://github.com/advisories/GHSA-8gh8-hqwg-xf34):
  2.2.1, paths: addons-linter>ajv-merge-patch>fast-json-patch

[willdurand]

I filed ajv-validator/ajv-merge-patch#54 for:

fast-json-patch (GHSA-8gh8-hqwg-xf34):
2.2.1, paths: addons-linter>ajv-merge-patch>fast-json-patch

[willdurand]

let's close this issue, I filed a new one for the last npm audit failure.