Dependencies vulnerabilities in attu@2.3.10

[fmulero]

Describe the bug:

Running a security scan such as Trivy on the latest released version reported several CVEs:

$ trivy --version
Version: 0.51.1

$ trivy image --vuln-type library zilliz/attu:v2.3.10
...
Node.js (node-pkg)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 1)

┌───────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│          Library          │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                          Title                           │
├───────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ protobufjs (package.json) │ CVE-2023-36665 │ CRITICAL │ fixed  │ 7.2.4             │ 7.2.5, 6.11.4 │ protobufjs: prototype pollution using user-controlled    │
│                           │                │          │        │                   │               │ protobuf message                                         │
│                           │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-36665               │
├───────────────────────────┼────────────────┼──────────┤        ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ tar (package.json)        │ CVE-2024-28863 │ MEDIUM   │        │ 6.2.0             │ 6.2.1         │ node-tar is a Tar for Node.js. node-tar prior to version │
│                           │                │          │        │                   │               │ 6.2.1 has...                                             │
│                           │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-28863               │
└───────────────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

Could you please confirm whether this vulnerabilities affect attu and if so, if there are any plan to update the affected depencencies?

Steps to reproduce:

1. Run trivy

Attu version:

v2.3.10

[fmulero]

Some CVEs were already reported in #221

[shanghaikid]

https://github.com/zilliztech/attu/releases/tag/v2.4.0

v2.4.0 has been released.