Testcafe depends on vulnerable versions of babel-plugin-module-resolver

[alverdal]

What is your Scenario?

npm audit reports a HIGH alert for a dependency of testcafe.

  json5  <1.0.2 || >=2.0.0 <2.2.2
Severity: high
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
fix available via `npm audit fix --force`
Will install testcafe@15.1.317922, which is a breaking change
node_modules/find-babel-config/node_modules/json5
node_modules/json5
node_modules/tsconfig-paths/node_modules/json5
node_modules/vue-loader/node_modules/json5
node_modules/vue-style-loader/node_modules/json5
  find-babel-config  <=1.2.0
  Depends on vulnerable versions of json5
  node_modules/find-babel-config
    babel-plugin-module-resolver  2.3.0 - 4.1.0
    Depends on vulnerable versions of find-babel-config
    node_modules/babel-plugin-module-resolver
      testcafe  1.9.5-rc.1 - 2.2.0
      Depends on vulnerable versions of babel-plugin-module-resolver
      node_modules/testcafe

What are you suggesting?

Upgrade dependency to v5 https://github.com/tleunen/babel-plugin-module-resolver/releases/tag/v5.0.0

What alternatives have you considered?

No response

Additional context

No response

[aleks-pro]

Hi @alverdal ,

Thank you for pointing out the issue to us. We will upgrade the babel-plugin-module-resolver package and include it in a new testcafe version.

[miherlosev]

Fixed in #7457.