Nodemailer-mailgun-transport: high severity vulnerability in netmask plugin

Hey, I tried to patch the package-lock.json to use a NON-VULNERABLE version of netmask - I think it worked? Let me know what you're seeing now :)

Looks fixed to me in a clean checkout + npm install

I'm still seeing it in a production project through yarn audit, though, I suspect it hasn't been published

@anachronic I published in npm as 2.0.3 - https://www.npmjs.com/package/nodemailer-mailgun-transport

Apparently nodemailer-mailgun-transport id using a now non-official mailgun library? Is this an easy swap to the "official" version? Seems like the proper dependency should be "mailgun.js" and then that will alleviate the security vulnerability (and hopefully help for future issues). Discussion here: https://github.com/mailgun/mailgun-js/issues/122

Yeah just change the dependency and rewrite the code bit of code that are used for the official library.
official plugin: https://www.npmjs.com/package/mailgun.js
deprecated plugin: https://www.npmjs.com/package/mailgun-js (its referenced in mailgun docs, hence the confusion)

official uses '...require=('mailgun.js) as opposed to ...require('mailgun-js')

Tired, but hope it was a tldr

@zhyrin guess someone is gonna have to do some research to see how much code rewrite is needed

not interested

@zhyrin guess someone is gonna have to do some research to see how much code rewrite is needed

Is #104 not a fix for this?

not interested

great! at least you're honest about how you like open source

Is #104 not a fix for this?

let me take a look

Look like the latest version of mail gun is still vulnerable? https://snyk.io/advisor/npm-package/mailgun-js

@omerlh We've upgraded to the other one - that one is deprecated

Which one? I can see the latest version is still vulnerable: https://snyk.io/advisor/npm-package/nodemailer-mailgun-transport

I believe this is solved in master (see #104), however, 2.0.3 (last version published) seems to point to the last commit before the fix.

Although I'm not sure, maybe publishing a new version solves this?

@orliesaurus can we get a new release based on @anachronic's point?

Yeah I definitely need to push the update that is in master! Thanks y'all!

Any timeline on this version bump? Should this ticket be closed before the latest version is updated to master?