Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: semver vulnerable version to 7.5.2 #7800

Closed

Conversation

jimcase
Copy link

@jimcase jimcase commented Dec 9, 2024

This pull request updates the semver library from a version vulnerable to a Regular Expression Denial of Service (ReDoS) attack to the patched version 7.5.2. The update addresses the vulnerability identified in the security advisory GHSA-c2qf-rxjj-qqgw.

@jcesarmobile
Copy link
Member

Thanks for the pull request, but since the dependency is declared as ^7.3.7, it should already pick latest 7.x version available.
Also the root package.json is not the one distributed on npm, but the one in cli folder.

I've sent a PR that forces latest version of semver and updates several other packages for the CLI as for the CLI there could be cases where it could keep an older version of semver if it's already installed.

#7808

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants