Comments (19)
An alternative / temporary solution could be to create a custom-configured Jimp by using @jimp/custom
, if you know, you are not using features from the @jimp/plugin-print
plugin. With that you can eliminate the problematic dependecy manually.
Please note, that you might run into some issues with that, if you are using Typescript (depending on your configuration, I made PR where I try to make the modular configuration more available: #1225 ).
from jimp.
If someone want to fork those deps into the jimp org and do the update I'll help make it happen
from jimp.
It's high time for parse-bmfont-xml
to be updated to include the latest xml2js
0.6.0 https://github.com/Leonidas-from-XIV/node-xml2js/tags but there's no movement in any of the already existing PRs:
mattdesl/parse-bmfont-xml#4
mattdesl/parse-bmfont-xml#5
If this won't progress, would the jimp devs fork it or find an alternative, please ? @hipstersmoothie @Marsup @zmedgyes @sjoerd108
from jimp.
A quick and dirty solution until parse-bmfont-xml
bumps xml2js
to 0.5.0 is to add an override to your package.json Leonidas-from-XIV/node-xml2js#671 (comment)
"overrides": {
"jimp": {
"xml2js": "^0.5.0"
}
}
and npm install
.
Note: overrides are only available since npm 8.3
from jimp.
@pzrq The nested form works perfectly fine. But there's a catch. Whenever you install a new package, e.g. npm install some-package
the defined override will not be taken into account at all, so the old xml2js will be reinstalled. This is some very strange quirk of npm and many people have run into this issue. The solution is to delete node_modules
and package-lock.json
and then do a clean npm install
of all packages. This will apply the override as expected.
I'm not sure if this is what you have run into, but most certainly many are struggling with this, still.
from jimp.
Very strange that nobody bothers to actually fix this #1223 (comment)
from jimp.
@lorand-horvath from your original workaround, I've tried adding the override to my package.json , deleted package-lock.json and node_modules, but I still see the vulnerability during the yarn audit process. Seems v. 0.4.5 keeps getting pulled in.
Am I doing something wrong?
from jimp.
@lorand-horvath yeah, I actually use nvm, and my node version is 20.0.0. And yes, I use yarn instead of npm because of speed reasons π .
But your suggestions did provide me a solution, and as per https://classic.yarnpkg.com/en/docs/selective-version-resolutions/#toc-how-to-use-it.
If you are using yarn, add this to your package.json for a quick and dirty solution:
"resolutions": {
"jimp/@jimp/plugins/@jimp/plugin-print/load-bmfont/parse-bmfont-xml/xml2js": "^0.6.0"
}
yarn uses resolutions not overrides π .
from jimp.
FWIW I'm now seeing this vulnerability categorized as moderate
. Not sure what has changed or if npm audit
works differently on different node versions. I'm on v16.20.0
.
from jimp.
A quick and dirty solution until
parse-bmfont-xml
bumpsxml2js
to 0.5.0 is to add an override to your package.json Leonidas-from-XIV/node-xml2js#671 (comment)"overrides": { "jimp": { "xml2js": "^0.5.0" } }
and
npm install
.Note: overrides are only available since npm 8.3
The nested form did not work for me in npm 9.6.3, though the following did reliably generate the upgraded non-vulnerable package-lock.json
I needed on npm install
:
"overrides": {
"xml2js": "^0.5.0"
}
from jimp.
Is there any progress available on the work in this vulnerability? I'm having the same issue here and I'm using v0.22.10.
from jimp.
No, same issue for me as of now.
from jimp.
This issue is still occurring for me as well.
from jimp.
@RazvanVuscan As per #1223 (comment) :
In package.json
add this, which will override xml2js
to the currently latest version 0.6.2:
"overrides": {
"jimp": {
"xml2js": "^0.6.0"
}
}
Then delete package-lock.json
and node_modules
.
Then npm install
. This will only work if you have npm 8.3 or newer - you can check with npm -v
.
This should work. If not, what version of node do you have? node -v
Edit: I see you're using yarn instead of npm. I haven't worked much with it. I'm not sure if and since what version of yarn are overrides supported, you'd have to dig a bit and find out. If you do, please let me know!
from jimp.
Perhaps jimp should not install all plugins automatically? I have no need to print bitmap fonts on my files, but plugin-print
is automatically included. It feels like something that should be made into an optional peer dependency
from jimp.
Seems like issue is causing security tools such as Snyk to flag Jimp. Is there a plan for a fix yet?
from jimp.
Fixed in mattdesl/parse-bmfont-xml#4
from jimp.
Hurray! There's nothing left to do here as users can now update their lockfiles without any changes necessary in jimp
That being said, I do think it'd be an improvement if all jimp plugins were not automatically installed: #1223 (comment)
from jimp.
If anyone wants to submit a pr to update our deps I'd approve! not installing all the default plugins is a pretty big breaking change and I don't think breaking changes are too worth it for this project
from jimp.
Related Issues (20)
- Error reading arraybuffer in production environment HOT 1
- Share some examples of how to use it.(Multi page tiff from multiple images)
- @jimp/png won't work with @jimp/custom
- .brightness() method does not affect brightness
- Upgrade dependancy version of xml2js HOT 1
- Save to specific width and height in inches HOT 1
- Jimp.decoders is undefined in browser with webpack and typescript
- ERR_PNPM_NO_MATCHING_VERSIONβ No matching version found for @jimp/plugin-scale@^0.22.12
- zlib_bindings problem when used in Vite with Typescript
- Do anyone can run jimp in latest reactjs project? HOT 1
- Unable to get it working in a Vue project. HOT 3
- [BUG] Error when using ES Modules with Jimp HOT 6
- Cannot load fonts in Web Worker
- Japanese characters not able to write and render image
- Unable to install jimp library through npm bcz of vulnerabilities checks HOT 2
- Update phin version HOT 8
- Reading base64 image from a Buffer is slow HOT 1
- nvm sorry my bad
- problem with the file path when reading the file
- autocrop cropEmpty: true
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jimp.