[BUG][opensearch-2.30.0]

[shashank-shridhar]

A couple of CVEs are present in this chart which require some component upgrades.

CVE-2024-21538 -> cross spawn to be upgraded to 7.0.5
axios has to be upgraded to 1.6.1 as part of CVE-2023-45857.

Is there any update or timeline when these issues will be remediated?

Thanks in advance!

[prudhvigodithi]

[Triage]
Hey @shashank-shridhar thanks for creating the issue, is there a chance you can PR the fix ?
@TheAlgo @DandyDeveloper @peterzhuamazon

[peterzhuamazon]

I do notice GHSA-3xgq-45jj-v275 in other repos as well.
As for https://nvd.nist.gov/vuln/detail/CVE-2023-45857 might need to take a look.

Thanks.

[peterzhuamazon]

Similar to #635, the related core and plugins are doing the updates.

We will update the to use the next 2.19.0 release in OpenSearch / OpenSearch-Dashboards.

Thanks.