🚨 Security Concern: @vercel/stega Introduced via contentful@11.4.3

[ran2207]

Overview

The package @vercel/stega is introduced via contentful@11.4.3, and it has been flagged with a high security score (300) by Snyk. However, there is no remediation path available. We are concerned about its potential security impact and whether it will be updated or removed in future releases.

---

Issue Details

• Affected Package: @vercel/stega
• Introduced via: contentful@11.4.3
• License: MPL-2.0
• Security Score: 300 (Snyk)
• Exploit Maturity: No remediation path available.

---

Impact

Since there is no fix or suggested remediation, it is unclear whether @vercel/stega poses a direct security risk. We need clarification on whether this package is necessary or if it can be removed/replaced in future versions of contentful.

---

Steps to Reproduce

1. Install contentful@11.4.3 in a project.
2. Run npm audit or snyk test.
3. Observe that @vercel/stega is flagged with a high security score (300).

---

Suggested Fix

• Clarify whether @vercel/stega is required for contentful or if it can be removed.
• Provide a recommended approach to mitigate any potential security risks.
• If an update is planned, provide an estimated timeline for a fix.

---

References

• [Snyk Advisory](https://security.snyk.io/)
• [Contentful GitHub Repository](https://github.com/contentful)

---

Next Steps

Could you confirm if @vercel/stega is an essential dependency for contentful@11.4.3? If a fix is not currently available, are there alternative approaches to mitigate potential risks?

Looking forward to your response. Thanks for your time!