Repository navigation
Remove ember-auto-import 1.12.1 DependencyTrack #11730
Description
Problem Statement
A security issue was detected in versions of ember-auto-import lower than 1.12.2, as it uses babel-traverse:6.26.0, would it be possible to remove the dependency on ember-auto-import 1.12.1?
Refs:
Dependency Tree
→ ember-auto-import:1.12.2
→ ember-cli-babel:6.18.0
→ broccoli-babel-transpiler:6.5.1
→ babel-core:6.26.3
→ babel-traverse:6.26.0
Solution Brainstorm
Remove ember-auto-import 1.12.1:
https://github.com/getsentry/sentry-javascript/blob/d2d2e0af05bd1ab2a3b296ad3ebb976285775193/packages/ember/package.json#L39C5-L39C46
Activity
AbhiPrasad commentedon Apr 22, 2024
@gabrieltrita I don't think this security warning is accurate because
ember-auto-importonly is used in development, nothing should be exposed in production.Could you pin
babel-traversevia a custom resolution to a higher version to get around this?@mydea is it a good idea to drop
ember-auto-importv1 for v8?mydea commentedon Apr 23, 2024
I think we can at the very least we can bump to 1.12.2. We could also think to drop 1.x overall (we are already in beta but I think this wouldn't be too bad to do still...)
feat(ember): Update ember dependencies (#11753)