tfjs-models npm packages have incorrectly defined dependencies

[pranavosu]

Please make sure that this is a build/installation issue. As per our GitHub Policy, we only address code/doc bugs, performance issues, feature requests and build/installation issues on GitHub. tag:build_template

System information

• OS Platform and Distribution (e.g., Linux Ubuntu 16.04): MacOS
• Mobile device (e.g. iPhone 8, Pixel 2, Samsung Galaxy) if the issue happens on mobile device: N/A
• TensorFlow.js installed from (npm or script link): npm
• TensorFlow.js version: https://www.npmjs.com/package/@tensorflow-models/face-detection@1.0.3
• CUDA/cuDNN version: N/A

Describe the problem
Some of the packages in the tfjs-models repo have transitive dependencies on rimraf > glob > inflight. inflight has a security issue explained here This prevents consumers installing @tensorflow-models/face-detection or a few other models.

Provide the exact sequence of commands / steps that you executed before running into the problem

• npm i @tensorflow-models/face-detection@latest
• npm explain inflight
• affected version of inflight in the dependency tree

Any other info / logs
I've created a PR to fix this issue for package consumers - tensorflow/tfjs-models#1543

[avmohansai]

Hi @pranavosu ,
Thank you for reporting this issue. I am able to install @tensorflow-models/face-detection; however, the installation is also pulling in inflight@1.0.6, which is known to have a security issue. I have escalated this issue to the team.

Could you please share the specific error message you are seeing while installing the package?

[pranavosu]

@avmohansai the error is

Issues with no direct upgrade or patch:
✗ Missing Release of Resource after Effective Lifetime [Medium Severity][https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116] in inflight@1.0.6
introduced by @org/my-package@5.0.0 > @tensorflow-models/face-detection@1.0.3 > rimraf@3.0.2 > glob@7.2.3 > inflight@1.0.6
No upgrade or patch available

[avmohansai]

Hi @pranavosu ,
Thanks for your reply and PR. The rimraf@3.0.2 > is deprecated(Rimraf versions prior to v4 are no longer supported) and it is a known issue, which is already been escalated to the team.
Thank you.