Skip to content

commons-server using vulnerable package bson-objectid v2.0.3 #829

@martin-bucinskas

Description

@martin-bucinskas

Describe the bug

@mockoon/commons-server currently uses a dependency bson-objectid v2.0.3.
According to npm v2.0.3 is the latest version.

This version contains vulnerable code which gets flagged by some security scanners.
The vulnerability in mind is the following:
security.snyk.io/vuln/SNYK-JS-BSONOBJECTID-570765

I know this package is used in a very minimal way to allow creation of IDs in templates, but it would be nice to either move away from using this package or get some support for the currently open PR for this fix (this PR has been opened since 2020 so doubt that much will happen soon).

Mockoon version
cli - 2.1.0

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

Status

✅ Done (ready for next release)

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions