orval icon indicating copy to clipboard operation
orval copied to clipboard

Should micromatch package in orval/core be bumped to 4.0.8 due to Snyk vulnerability report?

Open EddTally opened this issue 4 months ago • 1 comments

What are the steps to reproduce this issue?

  1. Run snyk test --severity-threshold=high on package after installing

What happens?

Receive error: ✗ Inefficient Regular Expression Complexity [High Severity][https://security.snyk.io/vuln/SNYK-JS-MICROMATCH-6838728] in [email protected] introduced by [email protected] > @orval/[email protected] > @orval/[email protected] > [email protected] and 1 other path(s) This issue was fixed in versions: 4.0.8

What were you expecting to happen?

Snyk to be fine with all Orval dependencies

Any other comments?

Synk report is here: https://security.snyk.io/vuln/SNYK-JS-MICROMATCH-6838728 Does this affect us and should we bump micromatch in orval/core to 4.0.8?

What versions are you using?

npmPackages: @tanstack/svelte-query: ^5.56.2 => 5.56.2 axios: ^1.7.7 => 1.7.7 msw: ^2.4.9 => 2.4.9 orval: ^7.1.1 => 7.1.1 svelte: ^4.2.19 => 4.2.19

EddTally avatar Oct 04 '24 13:10 EddTally