Mockery security vulnerability fix in 2.1.0 missing in release version 3.3.1

[kriti218]

The version 3.3.1 of azure-pipelines-task-lib is still referring to 1.7.0 version of mockery. Please let us know when are you planning to release another version of library after upgrading mockery version to 2.1.0.
This is a link to advisory https://www.mend.io/vulnerability-database/CVE-2022-37614

[kriti218]

Can someone please acknowledge this? It is important to fix this.

[localconst]

Hi @kriti218, the related changes has been merged to the source code - #878

We will publish it soon

[kriti218]

@Roman-Shchukin Thank you for the fix. When are you planning to make it release version instead of preview? We dont use preview versions in production.

[Roman-Shchukin]

Release 4.0.2 has just been published. https://www.npmjs.com/package/azure-pipelines-task-lib?activeTab=versions

[Roman-Shchukin]

Hi @kriti218. Does this release work for you?

[kriti218]

Hi @Roman-Shchukin Cant i upgrade to version 3.3.2 instead of 4.0.2? Does 3.3.2 suffice for the security fixes ?

[Roman-Shchukin]

Yes, ok, we will publish 3th version with these fix, it's real very important. And we are going to finish support for version 3th soon, since version 4th is already stable