npm audit would lead to downgrade to another vulnerable version

[lexibelseibert]

CLI Version

8.13.0

Node.js Version

v26.7.0

Operating System

Linux

Description

I ran npm audit and it suggests downgrading to an older version.

Steps to Reproduce

1. From a project containing the mentioned hs version, run npm audit
2. Review the suggestions

Expected Behavior

I expected a list of packages to upgrade.

Screenshots

No response

Debug Output

No response

Additional Context

Instead, I get a bunch of packages that say this:

Will install @hubspot/cli@7.0.2, which is a breaking change.

I'm not sure but this might be related to #1554 as well. Feel free to close if it's a duplicate, but then please advise how to proceed. We can't afford to keep high and critical vulnerabilities in our code.

[lexibelseibert]

Note that many of the downgrade versions are also vulnerable

[lexibelseibert]

One thing worth highlighting:

even if everything else was fixed, there is one thing that is unlikely to ever get a fix: https://github.com/max-mapper/extract-zip has had its last commit 5 years ago and should be considered unmaintained. That means, either this responsibility has to be picked up (forking, taking over the repo as maintainer...) and then fixing the vulnerable version, or you have to switch to another zip extraction library.

Since there hasn't been an update on this issue in a month tomorrow, can I get any indication if you're working on this or looking into it?

[camden11]

Hey @lexibelseibert, thanks for flagging this. The latest version of the CLI has fixes for most of the vulnerable dependencies that existed in 8.13.0, and we should have an additional patch out shortly that will resolve the rest of them