Solve security issue

[Vincent Langlet (VincentLanglet)]

Hi ellendular & Tarun Ramsinghani (@tarunramsinghani)

Closes #400

[Vincent Langlet (VincentLanglet)]

@microsoft-github-policy-service agree

[ellendular]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[manujSk]

Hi,
Is anyone looking into this PR?

[azure-pipelines]

Commenter does not have sufficient privileges for PR 403 in repo microsoft/typed-rest-client

[Vincent Langlet (VincentLanglet)]

ping ellendular maybe ?

[manujSk]

Hi ellendular,
can you please review, run the CI and merge this if there are no issues here?

[ellendular]

Hi Team,
Please post the PR in Group for review.
Ping me on v-ellendular@microsoft.com if you need more information.

[ellendular]

/azp run

[azure-pipelines]

No pipelines are associated with this pull request.

[Vincent Langlet (VincentLanglet)]

Hi Team, Please post the PR in Group for review. Ping me on v-ellendular@microsoft.com if you need more information.

Not sure to understand this message since I'm not from the microsoft team.

I'm just an open source contributor ; so I cannot "post the PR in Group for review".

[ellendular]

Hi Vincent Langlet, manujSk
I have posted PR for review.

[Tarun Ramsinghani (tarunramsinghani)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Eric Cornelissen (ericcornelissen)]

There is now

typed-rest-client/package.json

Line 48 in 18b9e95

"qs": "6.15.3",

on master, due to #406, which resolves GHSA-q8mj-m7cp-5q26 but neither GHSA-x5fp-wj9c-mxmx nor GHSA-4mjr-xmp4-gh2g so this change (or one like it) is still need.

[Vincent Langlet (VincentLanglet)]

Tarun Ramsinghani (@tarunramsinghani) I rebase the PR and fix it to use "qs": "^6.15.3", which would be better for later security issues.

For instance allowing to install the qs 6.16 version later https://www.npmjs.com/package/qs to solve security issues reporting mentionned by Eric Cornelissen (@ericcornelissen)

[Tarun Ramsinghani (tarunramsinghani)]

We will need exact version i.e. 6.16 to be mentioned in package-lock file to be able to ship updated version.

[Vincent Langlet (VincentLanglet)]

We will need exact version i.e. 6.16 to be mentioned in package-lock file to be able to ship updated version.

I feel like the registry
registry=https://pkgs.dev.azure.com/mseng/PipelineTools/_packaging/PipelineTools_PublicPackages/npm/registry/

Need to be updated first otherwise the package.lock would have been updated when I run npm update.

But anyway, this shouldn't be a real blocker. Your package-lock.json only matters for building/testing your repo itself, not for external consumption of the lib. As a consumer of the package, I don't use your lockfile — bumping the version in my own package.json and running install updates my own lockfile automatically and will use 6.16 since you're allowing it now.