Critical Security Patch url-parse 1.5.10

[suhail-n]

Problem

The current url-parse version 1.5.3 has the following critical vulnerabilities CVE-2022-0691, and CVE-2022-0686

Fix

This problem has been resolved in [email protected]

Change package.json from

 "dependencies": {
    "bitsyntax": "~0.1.0",
    "bluebird": "^3.7.2",
    "buffer-more-ints": "~1.0.0",
    "readable-stream": "1.x >=1.1.9",
    "url-parse": "~1.5.3"
  },

to:

 "dependencies": {
    "bitsyntax": "~0.1.0",
    "bluebird": "^3.7.2",
    "buffer-more-ints": "~1.0.0",
    "readable-stream": "1.x >=1.1.9",
    "url-parse": "~1.5.10"
  },

[tbreeding]

I updated it locally and ran the tests and they all passed.

[michal-ayash]

We're blocked on that issue. Do you have ETA?

[suhail-n]

We're blocked on that issue. Do you have ETA?

On your project try the command npm update url-parse

This shouldn't create any breaking changes. I applied this fix for my project and now I'm waiting for the fix to be applied to amqplib.

[davidsousa5]

We're blocked on that issue. Do you have ETA?

On your project try the command npm update url-parse

This shouldn't create any breaking changes. I applied this fix for my project and now I'm waiting for the fix to be applied to amqplib.

Do you have any idea when do you will release a new version with a fix for this issue?

[michal-ayash]

Any update??

[kibertoad]

This PR is blocked by CI failing. Anyone who could contribute fix for that would be very welcome.

[suhail-n]

If anyone needs the fix right away, I published a fork with the fix on NPM

Installation

npm i @suhailn/amqplib

Usage

const amqplib = require('@suhailn/amqplib')

Pull Request

I also went and published my pull request in PR-675

[suhail-n]

The change has been merged in. See PR-675

[michal-ayash]

@suhail-n, we need the fix in the original branch. any ETA?

[michal-ayash]

@suhail-n as we need the formal npm package and not this fork - I opened a new issue here, please handle that and don't close until you fix this in the original branch

[suhail-n]

The change should be in main branch. My merge was successful. That's why I closed it.

[michal-ayash]

thanks