msal-node using old jsonwebtoken npm pkg triggering npm audit issue

Question

we are using mssql npm package it has dependency with like below:

mssql > tedious > @azure/identity > @azure/msal-node > jsonwebtoken

Now we are getting below audit error: https://github.com/advisories/GHSA-27h2-hvpr-p74q

Any one already having this issue and know any workaround?

Answer 1

As a temporary measure, I had to use yarn's Selective dependency resolutions https://classic.yarnpkg.com/en/docs/selective-version-resolutions/

in package.json:

"resolutions": {
    "@azure/msal-node": "^1.17.0"
  }