[BUG]: CVE-2020-11023

[roman-rezinkin]

Project

cypress-accessibility-checker

Browser

No response

Operating system

No response

Description

There is an active CVE against JQuery, the root cause seems to be stemming from the deep-diff package.
Looking at the npm package, it looks deprecated and is not supported anymore.

https://www.npmjs.com/package/deep-diff?activeTab=readme

Steps to reproduce

Vulnerability testing from Mend causes this error.

[tombrunet]

@roman-rezinkin I'll look into what we can replace deep-diff with, but I do not see jquery in any of my package-lock files. The only reference I see to jquery in deep-diff is in a test html file that references jquery via a CDN - the package itself is not included in the node_modules dependencies, nor is it referenced by any of the files actually used by the dist package.

[tombrunet]

work around for now:

Add a postinstall script in your own package.json to delete the file after install:

   "scripts": {
     "postinstall": "rm -f node_modules/deep-diff/test/tests.html"
   }