Could you help remove the high severity vulnerability introduced in your package? #362

Hi ,@alexander-fenster @summer-ji-eng , I’d like to report a high severity vulnerability in your package:

Issue Description

A vulnerability (high severity) CVE-2020-7768 in package @grpc/grpc-js<1.1.8 is transitively referenced by [email protected]. We noticed that such vulnerability has been removed since [email protected].

However, google-gax's popular previous version [email protected] (240,523 downloads per week) is still transitively referenced by a large amount of latest versions of active and popular downstream projects (about 780 downstream projects, e.g., @xapp/ovai-cli 1.33.21, @sentrei/common 1.131.0, @sentrei/web 1.131.0, @xapp/stentor-service-analytics 1.33.20, @sentrei/ui 1.131.0, @fbg/[email protected] and [email protected], etc.). As such, issue CVE-2020-7768 can be propagated into these downstream projects and expose security threats to them.

These projects cannot easily upgrade google-gax from version 1.15.3 to >=2.6.2-beta.0 . For instance, [email protected] is introduced into the above projects via the following package dependency paths:
(1) @fbg/[email protected] ➔ @fbg/[email protected] ➔ @fbg/[email protected] ➔ @google-cloud/[email protected] ➔ @google-cloud/[email protected] ➔ [email protected] ➔ @grpc/[email protected]
(2) [email protected] ➔ [email protected] ➔ @google-cloud/[email protected] ➔ [email protected] ➔ @grpc/[email protected]
........

The projects such as @fbg/logger and google-pubsub-wrapper which introduced [email protected] are not maintained anymore. These unmaintained packages can neither upgrade google-gax nor be easily migrated by the large amount of affected downstream projects.
On behalf the downstream users, could you help us remove the vulnerability from package [email protected]?

Suggested Solution

Since these unactive projects set a version constaint ~1.15.* for google-gax on the above vulnerable dependency paths, if google-gax removes the vulnerability from 1.15.3 and releases a new patched version [email protected],
such a vulnerability patch can be automatically propagated into the 780 affected downstream projects.

In [email protected], you can kindly try to perform the following upgrade:
@grpc/grpc-js ~1.0.3 ➔ ~1.1.8;
Note:
@grpc/[email protected] (>=1.1.8) has fixed the vulnerability CVE-2020-7768

Thank you for your help.

Sincerely yours,
Paimon