Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unmaintained npm package xlsx used in fides admin-ui #3702

Open
daveqnet opened this issue Jun 29, 2023 · 0 comments
Open

Unmaintained npm package xlsx used in fides admin-ui #3702

daveqnet opened this issue Jun 29, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@daveqnet
Copy link
Contributor

daveqnet commented Jun 29, 2023

Bug Description

  • The 3rd party npm package xlsx is currently included in the fides admin-ui frontend for datamap .csv and .xlsx file exports
  • 0.18.5 is the final version of xlsx published to the npm registry by the SheetJS maintainers.
  • SheetJS have chosen to publish all xlsx versions > 0.18.5 only as self-hosted tarballs on cdn.sheetjs.com - see here for more info.
  • 0.18.5 is becoming a stale dependency version and accumulating security vulnerabilities such as CVE-2023-30533 (although note that this vuln is not exploitable in fides's use of the package).

Steps to Reproduce

n/a

Expected behavior

admin-ui's use of xlsx is deprecated in favor of a different npm package that is maintained.

Screenshots

n/a

Environment

  • Version: fides >= 2.10
  • OS: All supported
  • Python Version: All supported
  • Docker Version: All supported

Additional context

Technically it is possible to include SheetJS's self-hosted tarballs as dependencies, but I suspect this will lead to issues with Dependabot, which we rely on heavily for dependency security alerts and updates.

@daveqnet daveqnet added the bug Something isn't working label Jun 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant