Server-Side Request Forgery in Request

[damorjuancruz]

Output of running npm audit

❯ npm audit
# npm audit report

request  *
Severity: moderate
Server-Side Request Forgery in Request - https://github.com/advisories/GHSA-p8p7-x288-28g6
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/request
  mercadopago  >=0.0.8
  Depends on vulnerable versions of request
  Depends on vulnerable versions of request-etag
  node_modules/mercadopago
  request-etag  *
  Depends on vulnerable versions of request
  node_modules/request-etag

3 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

[romerosilva-meli]

Hi @damorjuancruz.

Thank you for reporting this vulnerability. We are working on a solution to this issue.

[ubinatus]

Hi @romerosilva-meli,

Any updates on this issue? The request package is way deprecated. This package is triggering moderate vulnerabilities when running the audit.

[lucmantovani]

Hello @ubinatus!

We are planning a new major version of the SDK without request package and newer language features, but we don't have a release date yet.

Please, keep an eye on this repository for updates

[ubinatus]

Hi @lucmantovani ! Thanks for the reply. Sounds great!

[ubinatus]

Uh oh! Awesome! Seems resolved on the latest release #268