Audit flagged version of adm-zip via onnxruntime-node@1.24.3 via @huggingface/transformers@4.2.0

[sroussey]

System Info

@huggingface/transformers@4.2.0

Environment/Platform

• Website/web-app
• Browser extension
• Server-side (e.g., Node.js, Deno, Bun)
• Desktop app (e.g., Electron)
• Other (e.g., VSCode extension)

Description

onnxruntime-node@1.24.3 has included adm-zip@0.5.18 which has security issues.

Reproduction

❯ bun audit --prod
[0.48ms] ".env.local"
adm-zip <0.6.0
workspace:@workglow-dev/builder-app › @huggingface/transformers
high: adm-zip: Crafted ZIP file triggers 4GB memory allocation - GHSA-xcpc-8h2w-3j85

❯ bun why adm-zip
[0.09ms] ".env.local"
adm-zip@0.5.18
└─ onnxruntime-node@1.24.3 (requires ^0.5.16)
└─ @huggingface/transformers@4.2.0 (requires 1.24.3)

[xenova]

Thanks for this information. There doesn't yet seem to be an onnxruntime-node version which supports 0.6.0, so updating (without overriding) wouldn't fix this. @fs-eire @prathikr can you take a look? :)

[xenova]

thanks for the fix @prathikr 👍 any timeline on a new npm release? :)