security issue: @microsoft/teamsfx-cli depends on adal-node which depends on xmldom version with security vulnerability

[JensMadsen]

see: Azure/ms-rest-nodeauth#146 (comment)

[ghost]

Thank you for contacting us! Any issue or feedback from you is quite important to us. We will do our best to fully respond to your issue as soon as possible. Sometimes additional investigations may be needed, we will usually get back to you within 2 days by adding comments to this issue. Please stay tuned.

[Alive-Fish]

Hi @JensMadsen, thanks for reporting it. I have checked the package-lock.json in the source code and cannot find the adal-node dependency.

Do you mean the latest published @microsoft/teamsfx-cli? If yes, I will reply to you when the new version has been published.

[JensMadsen]

Hi @Alive-Fish. You are right. Sorry about the noise. I was told by your colleagues to report it here but it turns out that it is the package that uses an old version see https://github.com/OfficeDev/Office-Addin-Scripts/blob/e9cd6b6456c7b79621e5d4c07206e6cc1ab47df9/packages/office-addin-dev-settings/package.json#L25. Sorry about the noise and sorry for not checking it properly! I close the issue