@uppy/companion depends on vulnerable versions of got and jsonwebtoken

[stefanhorning]

Initial checklist

• I understand this is a bug report and questions should be posted in the Community Forum
• I searched issues and couldn’t find anything (or linked relevant results below)

Link to runnable example

No response

Steps to reproduce

1. Add "@uppy/companion": "^4.2.0" to your package.json (depdendencies section)
2. Run npm install
3. Run npm audit

Expected behavior

Dependencies of @uppy/companion do not show up in output of npm audit.

Actual behavior

This output appears:

node_modules/jsonwebtoken
  @uppy/companion  *
  Depends on vulnerable versions of got
  Depends on vulnerable versions of jsonwebtoken

Which also prevents me to upgrade jsonwebtoken to version 9.0.0 in this project, as I planned to do in accordance with GHSA-qwph-4952-7xr6 and GHSA-hjrf-2m68-5959

[mifi]

as for jsonwebtoken, see #4258

as for got, which vulnerabilities does it have? we are on got@11.8.5 which has the latest security fixes, except for this: sindresorhus/got@v11.8.5...v11.8.6
however I believe that is not a security fix

[stefanhorning]

Hi, thanks for the quick reply!
I mostly opened this issue for the jsonwebtoken case and only mentioned got too as npm audit was complaining about that as well, but it's probably less relevant.

So as far as I am concerned this ticket could be closed with the jsonwebtoken issue already addressed :)

[mifi]

we're planning on making a new major companion version release with jsonwebtoken, but we want to include some more breaking things also

[mifi]

I believe this can be closed because jsonwebtoken was already upgraded to 9 #4751 and got in #5035