@cosmjs/[email protected] security vulnerability in dependency [email protected]

[300apm]

The package @cosmjs/[email protected] has a dependency @confio/[email protected] which has a dependency [email protected] that has a security vulnerability: GHSA-g954-5hwp-pp24

@confio/[email protected] has not been updated for more than 3 years.

Are there any plans to fix this? Dependabot has marked this as Critical

Thanks!

[webmaster128]

Thank you for bringing this up!

I added a deprecation message to @confio/ics23 to explain what happened here. This means the latest CosmJS depends on unmaintained packages and packages with open issues.

While I still do have access here, me and Confio doe not have a mandate to work on CosmJS for more than 1 year now. This is why such things are not addressed at this point.

[webmaster128]

CosmJS 0.33.0 released today removed the @confio/ics23 dependency and ICS23 features. protobufjs was upgraded to v7.