Specified version of @azure/identity does not remove uuid@8

[OLGE55]

On upgrading to applicationinsights@3.15.1, I'm still seeing the vulnerable uuid@8.3.0 dependency via @azure/identity@^4.13.1 -> @azure/msal-node@^5.1.0 despite a fix in #1498.

It may be that something about my setup is not automatically upgrading to @azure/msal-node@5.1.5 or newer as appears to have been the assumption in that fix and the expectation given the minor version compatibility. As it stands I've had to pin @azure/msal-node@^5.1.5 myself, which would preferably be handled by an upstream package instead.

[JacksonWeber]

Bumping @azure/identity to ^4.13.1 wasn't enough on its own. Identity only requires @azure/msal-node@^5.1.0 , but msal-node didn't drop uuid@8 until 5.1.5. So, the ^5.1.0 range still lets 5.1.0–5.1.4 (which pull uuid@8) resolve, especially if your lockfile or cache already had one pinned.

Unfortunately, we can't force this from our side. Overrides in our package.json don't apply to your install, and 4.13.1 is the newest identity release, so we can't tighten the range. The real fix has to come from @azure/identity raising its msal-node floor to >=5.1.5. I'll follow up on that.

[JacksonWeber]

I got Azure/azure-sdk-for-js#39425 merged on the @azure/identity side. Once the new identity package is released it can get pulled in here.