Is there a plan to update adf-schema library to fix the linkify high vulnerability described here https://socket.dev/npm/package/@atlaskit/adf-schema/alerts/56.1.5?tab=dependencies?
We have an app using adf-utils and security tools are flagging this vulnerability weeks ago.
Is there a plan to update adf-schema library to fix the linkify high vulnerability
Can’t speak for the roadmap, but the gap is wider than a patch bump. @atlaskit/adf-schema@56.1.18, published two days ago, still declares "linkify-it": "^3.0.3". Both HIGH advisories land in the 5.x line only, GHSA-22p9-wv53-3rq4 fixed in 5.0.1 and GHSA-v245-v573-v5vm in 5.0.2. A caret on 3 can’t reach either, so this needs a major bump of a transitive dep, not npm audit fix.
It’s reachable rather than shelfware. getLinkMatch in dist/cjs/utils/url.js runs adf-schema’s own LINK_REGEXP first and falls back to linkify.match() when the string has no http(s)/ftp/file:// prefix, so user-typed text takes the vulnerable path. Timing through normalizeUrl on 3.0.3, payload 'a@b.com\n'.repeat(n):
bytes=8000 33ms
bytes=16000 134ms
bytes=32000 527ms
bytes=64000 2102ms
Doubling gives 4x, and 'example.com '.repeat(n) follows the same curve. The mailto: vector from the second advisory didn’t reproduce for me on 3.0.3, 120 KB stayed at 6 ms, so I’d call that one unconfirmed on this path.
What worked here as an interim:
"overrides": { "linkify-it": "5.0.2" }
Nine URL cases through normalizeUrl come back byte-identical, custom sourcetree:, notes:, tel: and file: schemas included, and 64 KB drops from 2102 ms to 2 ms.
Don’t pin it to latest. linkify-it@6.1.0 reshaped its CJS build to a namespace { LinkifyIt, REBuilder, linkifyit } with no callable default, so adf-schema’s _interopRequireDefault throws:
TypeError: (0 , _linkifyIt.default) is not a function
at .../adf-schema/dist/cjs/utils/url.js:41
Whether you’re genuinely exposed depends on whether unbounded untrusted text reaches normalizeUrl. If you only normalize hrefs you already length-bound, the override answers the scanner rather than the risk, and that’s worth saying in that shape.