Vulnerability in `jimp>@jimp/types>@jimp/jpeg>jpeg-js` (High)

[yurivangeffen]

There seems to be a vulnerability deeply nested in the jimp package: https://github.com/advisories/GHSA-xvf7-4v9q-58w6. Unfortunately this seems to not be maintained, but maybe we can force a different version of jpeg-js somehow?

[steambap]

The only thing I can do is to migrate my code to only use pngjs in the future, since I'm only using the png part of the library. For now, you have to experiment with your local lock file to somehow force update jpeg-js.

[NJAldwin]

@steambap it sounds like it's possible to switch to jimp-compact to avoid the audit triggering on the vulnerability. Would that be possible here?

https://github.com/oliver-moran/jimp/issues/1088#issuecomment-1212287490

(I am the author of a library depending on this library, hoping we can get this vulnerability fixed shortly :) )

[steambap]

#17 I won't switch to jump-compact. I'll switch to pngjs.