You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@msrathore-db Could you please prioritize fixing the 2 critical and 11 high-severity dependency vulnerabilities? Dependabot has already opened PRs with fixes for many of them, and many could likely be resolved with npm audit fix.
This is becoming urgent for those of us with projects that depend on this package, as our security scanners are now flagging these issues. Some of the Dependabot PRs have been open for over a month, and critical/high-severity items remaining unresolved for that long triggers alerts across many security organizations. Given how seriously Databricks takes security, I was surprised to see a number of other PRs merged recently while none of the Dependabot fixes have been picked up.
We'd really appreciate it if these could be addressed ASAP. Thanks!
Reacted by David Morgan, Krzysztof Gwozdowicz, pcriado-ixpandit, Caio Paiva and 31453
Thanks for the update. Honestly, waiting on a major release with potential breaking changes is a lot less helpful than just dropping everything to patch the high and critical items. In many of our organizations, a critical finding has to be fixed in under a week.
Also worth noting: the two critical vulns (basic-ftp, form-data) aren't listed in the summary table or PR title, which only mentions HIGH/MED/LOW. The diff does appear to fix both, but it'd help to have that confirmed.
A patch release on the current major would let us clear these alerts now, while the major version proceeds on its own timeline.
Reacted by pcriado-ixpandit, Caio Paiva, Vaso Filipov and 31453
@msrathore-db Any update? 1.16.0 is shipping with none of the security fixes, #390 has had no commits in over two weeks, and the clean dependabot PRs (basic-ftp #372, follow-redirects #359, …) are still untouched. For those of us with critical/high findings on a clock, what's the realistic timeline?
Reacted by 31453, Vaso Filipov, Kevin-Chant, pcriado-ixpandit and Ivo Heidelbach
Activity
prepare release 1.15.0 (#395)
msrathore-db commentedon May 27, 2026
Hi @seeibt , thanks for reporting. This is being actively looked into and should be fixed with PR #390
kGwozdoBayer commentedon Jun 2, 2026
any ETA on when will it be fixed (pr merged)? @msrathore-db
awick commentedon Jun 2, 2026
@msrathore-db Could you please prioritize fixing the 2 critical and 11 high-severity dependency vulnerabilities? Dependabot has already opened PRs with fixes for many of them, and many could likely be resolved with
npm audit fix.This is becoming urgent for those of us with projects that depend on this package, as our security scanners are now flagging these issues. Some of the Dependabot PRs have been open for over a month, and critical/high-severity items remaining unresolved for that long triggers alerts across many security organizations. Given how seriously Databricks takes security, I was surprised to see a number of other PRs merged recently while none of the Dependabot fixes have been picked up.
We'd really appreciate it if these could be addressed ASAP. Thanks!
msrathore-db commentedon Jun 3, 2026
We'll be releasing a major version bump with these fixes. You can track this PR instead of the dependabot PRs #390
awick commentedon Jun 3, 2026
Thanks for the update. Honestly, waiting on a major release with potential breaking changes is a lot less helpful than just dropping everything to patch the high and critical items. In many of our organizations, a critical finding has to be fixed in under a week.
Also worth noting: the two critical vulns (basic-ftp, form-data) aren't listed in the summary table or PR title, which only mentions HIGH/MED/LOW. The diff does appear to fix both, but it'd help to have that confirmed.
A patch release on the current major would let us clear these alerts now, while the major version proceeds on its own timeline.
awick commentedon Jun 15, 2026
@msrathore-db Any update? 1.16.0 is shipping with none of the security fixes, #390 has had no commits in over two weeks, and the clean dependabot PRs (basic-ftp #372, follow-redirects #359, …) are still untouched. For those of us with critical/high findings on a clock, what's the realistic timeline?
1.17.0: clear CRITICAL + transitive OSV findings via overrides (non-b…
2.0.0: breaking security bump — Node >=20, thrift 0.23, uuid 11, lz4→…