Security advisory for csvjson (CVE-2025-57318)

[chris-martin]

Please see GHSA-xq4f-3jxp-qv6m - This application may want to choose a different CSV library.

[adrai]

Opened an issue here: pradeep-mishra/csvjson#35

But since locize-cli is a cli chances are low to inject a prototype pollution...

[mRoca]

@adrai It seems that csvjson is totally abandoned since 2018. Imho, the safest would be using another lib like https://www.npmjs.com/package/fast-csv .

I could create a PR, but there is no unit test in the repo and it's an old-style not-typed JS project: I dunno how to be sure there is no BC break after changing the lib.

[adrai]

@mRoca you're right... we'll gone use fast-csv... in the next version...

[adrai]

v11.1.0 has just been released ;-)

[mRoca]

@adrai good (and quick) job !