Vulnerability in async dependency

[RakhimAimaganbetov]

Guys, can you always keep the async dependency up to date?

Or can you use a higher version of async than 2.6.3 in the next release, please? We would like to avoid npm audit warnings.

Thank you in advance!

[AsifImam]

JFROG vulnerability scan also picked this up with following info In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. Request to publish a new package with this vulnerability fixed. Thanks.

[RakhimAimaganbetov]

The developers of "async" confirm that the vulnerability has been already fixed on their side, and ask you to update the version of the dependencies.

Can I ask you to publish a new release with an update of the "async" dependency? Thanks!

[RakhimAimaganbetov]

Here is a new node-java version which contains a fix for the issue described above.