High severity vulnerability found in dependency of hapi-swagger

Context

• hapi-swagger version: 9.3.1

What are you trying to achieve or the steps to reproduce?

Run vulnerability detection tool such as snyk

Output:

What result did you get?

Because of hapi-swagger’s dependency on handlebars@4.0.12 there is a Prototype Pollution vulnerability being flagged when running snyk.

What did you expect?

hapi-swagger to be using the latest version of handlebars (v4.1.0) which is not affected by this vulnerability.

[robmcguinness]

@rossanthony I got the idea from another user https://github.com/glennjones/hapi-swagger/issues/495#issuecomment-358675357 (re-pasting here):

const HapiSwagger = require('hapi-swagger');
const HapiSwaggerUI = require('hapi-swaggered-ui');

const swagger = {
  plugin: HapiSwagger,
  options: {
    documentationPage: false,
    ...
  },
};

const swaggerUI = {
  plugin: HapiSwaggerUI,
  options: {
    path: '/documentation',
    swaggerEndpoint: '/swagger.json',
    ...
  },
};

...

await server.register(swagger);
await server.register(swaggerUI);

We could just use swagger-ui-dist but maybe we would just be recreating hapi-swaggered-ui. I’m all for anything that makes the UI maintenance easier.

[robmcguinness]

Closed in v10.0.0