Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating vulnerable firebase-admin version from 10.0.0 -> 12.1.0 #646

Open
JeronimasDargis opened this issue May 10, 2024 · 0 comments
Open

Comments

@JeronimasDargis
Copy link

JeronimasDargis commented May 10, 2024

Version
@nuxtjs/firebase: 8.2.2

Hi! 👋

I have noticed that this package is using a vulnerable firebase-admin version. firebase-admin version and its peer dependencies currently used in nuxt/firebase are responsible for multiple critical vulnerabilities.

If you run npm audit you'll find these CVE's being referenced:

GHSA-4g6q-77j7-vvjc
GHSA-h755-8qp9-cq85

I want to propose updating firebase-admin to 12.1.0

diff --git a/node_modules/@nuxtjs/firebase/package.json b/node_modules/@nuxtjs/firebase/package.json
index eb1f421..159d339 100644
--- a/node_modules/@nuxtjs/firebase/package.json
+++ b/node_modules/@nuxtjs/firebase/package.json
@@ -69,6 +69,6 @@
     }
   },
   "optionalDependencies": {
-    "firebase-admin": "^10.0.0"
+    "firebase-admin": "^12.1.0"
   }
 }

This issue body was partially generated by patch-package.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant