Good morning, I'm not sure if this is on your radar, but yesterday and this morning I was hit with five snyk violations due to allegedly vulnerable direct and transitory dependencies of

@pact-foundation/pact

. I can get around this with a combination of overrides in

package.json

and exceptions in the

.snyk

file, but it would be better to avoid this.

Issues with no direct upgrade or patch:
  ✗ Asymmetric Resource Consumption (Amplification) [High Severity][<https://security.snyk.io/vuln/SNYK-JS-BODYPARSER-7926860>] in body-parser@1.20.2
    introduced by @pact-foundation/pact@13.1.2 > body-parser@1.20.2
  This issue was fixed in versions: 1.20.3
  ✗ Cross-site Scripting [Medium Severity][<https://security.snyk.io/vuln/SNYK-JS-EXPRESS-7926867>] in express@4.19.2
    introduced by @pact-foundation/pact@13.1.2 > express@4.19.2
  This issue was fixed in versions: 4.20.0, 5.0.0
  ✗ Cross-site Scripting [Low Severity][<https://security.snyk.io/vuln/SNYK-JS-SEND-7926862>] in send@0.18.0
    introduced by @pact-foundation/pact@13.1.2 > express@4.19.2 > send@0.18.0
  This issue was fixed in versions: 0.19.0, 1.1.0
  ✗ Cross-site Scripting [Low Severity][<https://security.snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865>] in serve-static@1.15.0
    introduced by @pact-foundation/pact@13.1.2 > express@4.19.2 > serve-static@1.15.0
  This issue was fixed in versions: 1.16.0, 2.1.0
  ✗ Regular Expression Denial of Service (ReDoS) [Medium Severity][<https://security.snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106>] in path-to-regexp@0.1.10
    introduced by @pact-foundation/pact@13.1.2 > express@4.19.2 > path-to-regexp@0.1.10
  This issue was fixed in versions: 8.0.0

We have dependabot/snyk enabled on https://github.com/pact-foundation/pact-js, I don’t see any PRs yet. You could create an issue and raise a PR to address if you like?

Sorry for the misunderstanding, but I am not in a position where I can undertake to do this. These reports came from our internal builds.

Thanks for sharing, we’ll merge the updates when they come in via automation. For now, looking at the reports I think you can see they’re unlikely to be applicable given the tool and how its used

awesome thank you

release just went out too