esbuild <=0.24.2 security vulnerability

[romulodgomes]

Current behavior

cypress-cucumber-preprocessor is using a version of esbuild lower than 25, and it has security issue.

GHSA-67mh-4wv8-2f99

Desired behavior

Upgrade esbuild to version 25 or higher.

Cypress version

13.17.0

Preprocessor version

22.0.0

Node version

18.14.2

Operating system

Windows

Checklist

• I've read the FAQ.
• I've read instructions for logging issues.
• I'm not using cypress-cucumber-preprocessor@4.3.1 (package name has changed and it is no longer the most recent version, see #689).

[badeball]

cypress-cucumber-preprocessor is using a version of esbuild [..]

Exactly how so?

[triori]

Have the same issue.
The log of npm audit

esbuild  <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server and read the response - https://github.com/advisories/GHSA-67mh-4wv8-2f99
fix available via `npm audit fix --force`
Will install @badeball/cypress-cucumber-preprocessor@20.1.2, which is a breaking change
node_modules/tsx/node_modules/esbuild
  tsx  >=3.13.0
  Depends on vulnerable versions of esbuild
  node_modules/tsx
    find-cypress-specs  >=1.42.0
    Depends on vulnerable versions of tsx
    node_modules/find-cypress-specs
      @badeball/cypress-cucumber-preprocessor  >=21.0.0
      Depends on vulnerable versions of find-cypress-specs
      node_modules/@badeball/cypress-cucumber-preprocessor

dependencies:

"dependencies": {
    "adm-zip": "^0.5.16",
    "axios": "^1.7.9",
    "country-code-lookup": "^0.1.3",
    "detect-browser": "^5.3.0",
    "odiff-bin": "3.2.0",
    "os": "^0.1.2",
    "postcode-validator": "^3.10.2",
    "typescript": "^5.7.3"
  },
  "devDependencies": {
    "@badeball/cypress-cucumber-preprocessor": "^22.0.1",
    "@bahmutov/cypress-esbuild-preprocessor": "^2.2.4",
    "@cypress/xpath": "^2.0.3",
    "axe-core": "^4.10.2",
    "cypress": "^14.0.3",
    "cypress-axe": "^1.6.0",
    "cypress-cdp": "^1.6.41",
    "cypress-file-upload": "^5.0.8",
    "cypress-if": "^1.13.2",
    "cypress-real-events": "^1.14.0",
    "cypress-terminal-report": "^7.1.0",
    "gherkin-lint": "^4.2.4",
    "multiple-cucumber-html-reporter": "^3.9.1",
    "node-xlsx": "^0.24.0",
    "prettier": "3.5.1"
  }

[badeball]

These are transitive dependencies which I don't own nor can't change. When something can be updated here, it automatically will be.

[badeball]

privatenumber/tsx#700

[triori]

@badeball you may close that issue because of privatenumber/tsx#698
Not reproducing anymore