Security issue with "extract-zip" and outdated "puppeteer" version

[koehnlein]

Hi everybody,

there is current security issue with "extract-zip" GHSA-jmr9-qjv8-65gv

Unfortunately, this is related to BackstopJS as you can see here below. While there is also "puppeteer" in this chain, there is no hope, they will solve the problem for us: puppeteer/puppeteer#15333

It would be great to see an update of BackstopJS which uses a newer version of puppeteer.

# npm audit report

extract-zip  *
Severity: high
extract-zip unvalidated symlink path traversal - https://github.com/advisories/GHSA-jmr9-qjv8-65gv
fix available via `npm audit fix --force`
Will install backstopjs@6.2.2, which is a breaking change
node_modules/extract-zip
  @puppeteer/browsers  <=2.13.2
  Depends on vulnerable versions of extract-zip
  node_modules/@puppeteer/browsers
    puppeteer  19.8.1 - 24.43.1
    Depends on vulnerable versions of @puppeteer/browsers
    Depends on vulnerable versions of puppeteer-core
    node_modules/puppeteer
      backstopjs  >=6.3.1
      Depends on vulnerable versions of puppeteer
      node_modules/backstopjs
    puppeteer-core  19.8.4 - 24.43.1
    Depends on vulnerable versions of @puppeteer/browsers
    node_modules/puppeteer-core

[ericdsd]

Hi are there any chances to expect a new backstop release, @garris this is a great project and it's too bad to see it dying, maybe you could open it to new maintainership or co-maintainership (i sadly have no skills for that though) ?

[garris]

You are right. It is way past time for me to pass the baton. I have just added a post looking for a new maintainer/owner. Regards.