lit-analyzer
lit-analyzer copied to clipboard
runem
Update to fast-glob >3.0.0 in lit-analyzer to avoid security vulnerability
fast-glob <=2.2.7 is vulnerable due to dep on old version of glob-parent.
https://github.com/advisories/GHSA-ww39-953v-wcq6
This dep was fixed by https://github.com/runem/lit-analyzer/pull/244 but we're still pending the release. It looks like the changelog was prepped but I'm not sure if something else is required? @rictic
I see that there have been active releases of the VS Code plugin but the tsconfig plugin has not seen a release in quite awhile: https://www.npmjs.com/package/ts-lit-plugin
Can the recent changes be published to npm as well?
Just pinging this bug since ts-lit-plugin still has this vulnerability. Should we not be using that plugin? What's the alternative?
Is there some blocker that makes it hard to publish the plugin with the new version?
Seems the ts-lit-plugin package hasn't been updated still; is there something we can do to help as members of the community?
Just checking in on this issue to see if there's anything I could do to help get a new release published!
