transitive dependency @tootallnate/once has an advisory and is flaged as a low vulnerability

[q42jaap]

Unable to update dependency on vulnerable npm package. I tried doing this with dependabot in my project:

Dependabot cannot update @tootallnate/once to a non-vulnerable version The latest possible version that can be installed is 2.0.0 because of the following conflicting dependencies:
firebase-functions-test@3.4.1 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
firebase-functions@7.0.5 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
firebase-admin@13.6.1 requires @tootallnate/once@2 via a transitive dependency on http-proxy-agent@5.0.0
No patched version available for @tootallnate/once The earliest fixed version is 3.0.1.

GitHub advisory: GHSA-vpq2-c234-7xj6

http-proxy-agent is currently at 8.0.0.

[CorieW]

Hi @q42jaap. Thanks for opening this issue! We'll review it as soon as possible.

[swseverance]

@q42jaap If I run the following commands in a new npm project:

npm i firebase-functions
npm ls @tootallnate/once

I see the following result:

repro1835@1.0.0 /Users/sam/Documents/repro1835
└─┬ firebase-functions@7.2.5
  └─┬ firebase-admin@13.10.0
    └─┬ @google-cloud/storage@7.19.0
      └─┬ teeny-request@9.0.0
        └─┬ http-proxy-agent@5.0.0
          └── @tootallnate/once@2.0.1

It seems like a 2.0.1 patch version of the once library that fixes the vulnerability has now been released

Running npm audit currently mentions the following:

# npm audit report

@tootallnate/once  <3.0.1
@tootallnate/once vulnerable to Incorrect Control Flow Scoping - https://github.com/advisories/GHSA-vpq2-c234-7xj6

However, perhaps once this PR is fixed and merged the warning will go away

TLDR Unless I'm mistaken firebase-functions doesn't need to do anything at this point except wait for the advisory database to be updated.