jsonwebtoken is breaking Firebase Admin SDK about firebase-admin-node

[google-oss-bot]

Hey there! I couldn't figure out what this issue is about, so I've labeled it for a human to triage. Hang tight.

[hiranya911]

What exactly is the problem here? Can you provide more details about the type of error/vulnerability found in jsonwebtoken?

[motss]

@hiranya911 When running snyk test command, it will check all the NPM dependencies and it hit the jsonwebtoken dependency inside the firebase-admin with the error Invalid error: Invalid version: "https://registry.npmjs.org/@types/jsonwebtoken/-/jsonwebtoken-7.2.0.tgz and the snyk check stops and never able to complete the vulnerability check.

Is this something related to firebase-admin?

[hiranya911]

I still don't understand what the problem is. Why is 7.2.0 an invalid version? It is not the latest version available (latest seems to be 7.4.1). But it should be fine to depend on an older version.

[hiranya911]

I'm closing this, as it appears this is not a Firebase SDK issue. Check the referenced snyk issue for more context.