1544 update jsonpath package

[milanmayr]

Update jsonpath package to remediate CVE-2024-21534

[milanmayr]

resolves #1544

[rick-aguayo]

What is the timeframe for this PR to get reviewed, approved and merged?

[jaredperreault-okta]

We are working on upgrading jsonpath-plus, however our current usage of already disables eval

POC: 7ab2f4e#diff-9e03680efb5f8da7b469de8eb39f499e8e696a20f9085319dbb4d7a17e794717R14

[chaitanyareddy-mula]

Hey @milanmayr, will there be any breaking change if i override the "jsonpath-plus" to ^10.0.0 in order to mitigate the risk in my project until the fix is merged?

[milanmayr]

Hey @milanmayr, will there be any breaking change if i override the "jsonpath-plus" to ^10.0.0 in order to mitigate the risk in my project until the fix is merged?

Yes, I believe so, because in the newer version, the preventEval option has been changed to eval

[milanmayr]

We are working on upgrading jsonpath-plus, however our current usage of already disables eval

POC: 7ab2f4e#diff-9e03680efb5f8da7b469de8eb39f499e8e696a20f9085319dbb4d7a17e794717R14

@jaredperreault-okta considering y'all are already working on this, should I abandon this PR and let all discussion continue in #1544 ?

[jaredperreault-okta]

@chaitanyareddy-mula Yes. jsonpath-plus@10.0.0 requires node 18+ and the API signature has changed

[milanmayr]

This PR is closed -- work on this can be followed at 7ab2f4e#diff-9e03680efb5f8da7b469de8eb39f499e8e696a20f9085319dbb4d7a17e794717R14

[jaredperreault-okta]

Addressed in 7.8.1 (released on npm)