jsonwebtoken <=8.5.1 vulnerabilities

[fancywriter]

Which packages are impacted by your issue?

@graphql-codegen/cli

Describe the bug

Hello!

I am using @graphql-codegen/cli and recently npm audit started to show the following:

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
fix available via `npm audit fix --force`
Will install @graphql-codegen/[email protected], which is a breaking change
node_modules/jsonwebtoken
  @graphql-tools/prisma-loader  6.0.16-alpha-08d81492.0 - 7.2.48
  Depends on vulnerable versions of jsonwebtoken
  node_modules/@graphql-tools/prisma-loader
    @graphql-codegen/cli  1.17.8-alpha-091dfeae.0 - 1.17.8 || >=1.21.5-alpha-0a04346b.0
    Depends on vulnerable versions of @graphql-tools/prisma-loader
    node_modules/@graphql-codegen/cli

3 vulnerabilities (2 moderate, 1 high)

It advises to downgrade to older version.

I see it uses prisma-loader which was recently upgraded ardatan/graphql-tools#4923

Your Example Website or App

.

Steps to Reproduce the Bug or Issue

npm i --save-dev @graphql-codegen/cli@latest
npm audit

Expected behavior

npm audit to no complain or to propose non-breaking fix

Screenshots or Videos

No response

Platform

• OS: Linux
• NodeJS: 18.12.1
• graphql version: latest
• @graphql-codegen/cli version(s): 2.16.1

Codegen Config File

No response

Additional context

No response

[saihaj]

https://github.com/dotansimha/graphql-code-generator/releases/tag/release-1672172825816