{"action":"closed","issue":{"url":"https://api.github.com/repos/google/google-api-nodejs-client/issues/460","repository_url":"https://api.github.com/repos/google/google-api-nodejs-client","labels_url":"https://api.github.com/repos/google/google-api-nodejs-client/issues/460/labels{/name}","comments_url":"https://api.github.com/repos/google/google-api-nodejs-client/issues/460/comments","events_url":"https://api.github.com/repos/google/google-api-nodejs-client/issues/460/events","html_url":"https://github.com/google/google-api-nodejs-client/issues/460","id":96376426,"number":460,"title":"Warning about security issue in submodule","user":{"login":"nathanpeck","id":3495674,"avatar_url":"https://avatars.githubusercontent.com/u/3495674?v=3","gravatar_id":"","url":"https://api.github.com/users/nathanpeck","html_url":"https://github.com/nathanpeck","followers_url":"https://api.github.com/users/nathanpeck/followers","following_url":"https://api.github.com/users/nathanpeck/following{/other_user}","gists_url":"https://api.github.com/users/nathanpeck/gists{/gist_id}","starred_url":"https://api.github.com/users/nathanpeck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nathanpeck/subscriptions","organizations_url":"https://api.github.com/users/nathanpeck/orgs","repos_url":"https://api.github.com/users/nathanpeck/repos","events_url":"https://api.github.com/users/nathanpeck/events{/privacy}","received_events_url":"https://api.github.com/users/nathanpeck/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-21T17:51:09Z","updated_at":"2016-03-04T06:35:50Z","closed_at":"2016-03-04T06:35:50Z","body":"This module has a dependency with a security warning:\r\n\r\n```\r\nnpm WARN deprecated jws@0.0.2: Security update: Versions below 3.0.0 are deprecated.\r\n```\r\n\r\nThe [changelog](https://github.com/brianloveswords/node-jws/blob/master/CHANGELOG.md) has more details about that security warning:\r\n\r\n```\r\nThis mitigates a critical security flaw in the library which would allow an attacker\r\nto generate signatures with arbitrary contents that would be accepted by jwt.verify.\r\n```\r\n\r\nHere is the dependency tree showing how this vulnerable submodule is being included in the google api client:\r\n\r\n```\r\n\"googleapis\": {\r\n      \"version\": \"2.1.1\",\r\n      \"from\": \"googleapis@2.1.1\",\r\n      \"resolved\": \"https://registry.npmjs.org/googleapis/-/googleapis-2.1.1.tgz\",\r\n      \"dependencies\": {\r\n        \"gapitoken\": {\r\n          \"version\": \"0.1.4\",\r\n          \"from\": \"gapitoken@>=0.1.2 <0.2.0\",\r\n          \"resolved\": \"https://registry.npmjs.org/gapitoken/-/gapitoken-0.1.4.tgz\",\r\n          \"dependencies\": {\r\n            \"jws\": {\r\n              \"version\": \"0.0.2\",\r\n              \"from\": \"jws@0.0.2\",\r\n              \"resolved\": \"https://registry.npmjs.org/jws/-/jws-0.0.2.tgz\",\r\n```\r\n\r\nI'd appreciate it if this client was updated to correct this, as it isn't very nice to see security warnings when doing `npm install`, especially originating from the google api client."}}