Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Is grpc pulling in old dependencies? npm audit reporting an issue with an old version of y18n

See original GitHub issue

Problem description

I started receiving an npm audit issue today, which is traced back to the grpc package:

$ yarn audit --groups dependencies
yarn audit v1.22.5
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ y18n                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.0.5||>=4.0.1 <5.0.0||>=3.2.2 <4.0.0                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ graphql-server                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ graphql-server > grpc > protobufjs > yargs > y18n            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1654                        │
└───────────────┴──────────────────────────────────────────────────────────────┘

yarn why output confirms that the offending version is originating from grpc:

=> Found "grpc#y18n@3.2.1"
info Reasons this module exists
   - "_project_#graphql-server#grpc#protobufjs#yargs" depends on it
   - Hoisted from "_project_#graphql-server#grpc#protobufjs#yargs#y18n"

Is grpc pulling in an old version of a dependency?

Issue Analytics

State:
Created 2 years ago
Comments:6 (4 by maintainers)

Top GitHub Comments

1reaction

murgatroid99commented, Mar 30, 2021

The deprecation is scheduled for late April.

0reactions

murgatroid99commented, May 7, 2021

The grpc package has been deprecated. We will not fix this.

Top Results From Across the Web

How to fix npm dependency hell - Sylhare's blog

The easy fix is to use the npm audit fix which will look for updates that can be updated to fix those automatically....

Open Source Used In UBI SDWAN Reporting Dashboard 1.2

This document contains licenses and notices for open source software used in this product.

NPM Dependency errors? Then You're doing it wrong. - Medium

The answer is bad dependency tree management. This is a common problem within the NPM ecosystem which every developer faces. Libraries are changing...

newrelic/NEWS.md - UNPKG

When Infinite Tracing endpoints reconnected they would instantiate a new gRPC client prior to calling `client.recordSpan()`. It appears several objects created ...

RHSA-2021:2438 - Security Advisory - Red Hat Customer Portal

Topic. Red Hat OpenShift Container Platform release 4.8.2 is now ... secure access-token logging by default and delete old non-sha256 tokens ...