Dependency url-signature using a version of crypto-js with critical vulnerability about google-maps-services-js HOT 6 CLOSED

If you would like to upvote the priority of this issue, please comment below or react on the original post above with 👍 so we can see what is popular when we triage.

@elrond30 Thank you for opening this issue. 🙏
Please check out these other resources that might help you get to a resolution in the meantime:

• Check the issue tracker - bugs and feature requests for Google Maps Platform APIs and SDKs
• Open a support case - Get 1:1 support in Cloud Console.
• Discord - chat with other developers
• StackOverflow - use the google-maps tag

This is an automated message, feel free to ignore.

from google-maps-services-js.

v1.0.30 of js-url-signature has been released with the updated dependency. We'll need to update the dependency in this library to pull that in.

from google-maps-services-js.

@usefulthink after you merge #1046, could you update this dependency? Causing a CVE.

from google-maps-services-js.

Since the dependency range in the current package.json includes minor and patch releases of js-url-signature at or above v1.0.4, this library now will pull in v1.0.30 without any changes required (may require an npm audit fix for existing projects). Lowering priority to update the listed dependency at next sensible update.

from google-maps-services-js.

Fixed by #1110

from google-maps-services-js.

Thank you for the fix

from google-maps-services-js.