Img scan failing in Tekton pipeline due to critical vulnerability in 'static-eval'

[rubengmz]

We have been using this template for quick demos for a while, but the tekton pipeline isn't working now due to a Image vulnerability related to static-eval.

Looking into the package-lock.json we saw this is a dependency coming from ibm-cloud-env > jsonpath

From static-eval codebase (https://github.com/browserify/static-eval) we can see also there is a recent commit mention that it could cause security problems.

They have an issue open (browserify/static-eval#34) taking about CVE was going to revoke the vulnerability but still happen two months later.

We tried to fix dependecy manually but the problem is CVE says all versions are vulnerable: https://avd.aquasec.com/nvd/cve-2021-23334/

Any workaround that we could use to sort this problem out? Not sure if you have more recent templates for NodeJs or Angular project