CVE-2022-25758 (High) detected in scss-tokenizer-0.2.3.tgz - autoclosed about manageiq-ui-service

[MelsHyrule]

➜  manageiq-ui-service git:(master) ✗ yarn why scss-tokenizer
└─ sass-graph@npm:2.2.5
   └─ scss-tokenizer@npm:0.2.3 (via npm:^0.2.3)
➜  manageiq-ui-service git:(master) ✗ yarn why sass-graph
y└─ node-sass@npm:4.14.1
   └─ sass-graph@npm:2.2.5 (via npm:2.2.5)
➜  manageiq-ui-service git:(master) ✗ yarn why node-sass
└─ angular-patternfly@npm:5.0.3
   └─ node-sass@npm:4.14.1 (via npm:^4.11.0)

This is tied up with angular-patternfly which we're actively working to remove. However CVE can be resolved if we either (1) upgrade node-sass to v8 or higher (requires node v18) or (2) force upgrading scss-tokenizer using yarn's selective dependency resolutions field.

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.