Json5 Vulnerability with rewire/babel - CVE-2022-46175

[juanri0s]

Describe the bug
Not sure if this repo is being maintained anymore. But npm audit brings up api-client bringing in [email protected] through rewire package in this repo `

vgs-api-client-typescript/package.json

Line 21 in 091a7c0

"rewire": "^3.0.2"

. Rewire 4.0 removes the babel dependency https://github.com/jhnns/rewire/releases/tag/v4.0.0.

@vgs/[email protected] > [email protected] > [email protected] > [email protected]

CVE -
GHSA-9c47-m6qq-7p4h

Label the issue properly.

• Add severity/ label.
• Add documentation label if this issue is related to documentation changes.

To Reproduce
Steps to reproduce the behavior:

1. run npm audit

Expected behavior
[email protected]: and shouldnt come up in the lock file and should be 7.9 if its still being brought in from other packages. rewire 4.0 removes it though.

Screenshots

Environment and Versions (please complete the following information):
A clear and precise description of your setup:

• using latest version

Additional context

• Set up security policy in GH