Critical Vulnerability in React PDF

[levisiebensecfx]

Description

The current version of Verba uses @react-pdf/[email protected] which consumes legacy-swc helpers (@react-pdf/[email protected] › @react-pdf/[email protected] › [email protected] › @swc/[email protected] › [email protected]). This library has a severe vulnerability which would need to be addressed before being able to trust the overall project.

Snyk Report for Issues: https://security.snyk.io/vuln/SNYK-JS-LEGACYSWCHELPERS-7647380
React PDF Issue: diegomura/react-pdf#2839

Installation

N/A

If you installed via pip, please specify the version:

Weaviate Deployment

N/A

Configuration

Steps to Reproduce

Run a vulnerability scan on the repro (in this case Snyk). This vulnerability will be shown.

Additional context

[thomashacker]

Thanks a lot for the issue! We'll look into that