mochapack icon indicating copy to clipboard operation
mochapack copied to clipboard

Vulnerability warning in glob-parent

Open Lucidiot opened this issue 3 years ago • 1 comments

  • [x] I'd be willing to submit the fix

Describe the bug

An NPM vulnerability advisory is shown with glob-parent, a dependency of mochapack. Bumping it to ^5.1.2 or at least ~5.1.0 could remove the warning.

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ mochapack                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ mochapack > glob-parent                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

To Reproduce

  1. Install [email protected] as a dependency of any project
  2. Run npm audit

Environment if relevant (please complete the following information):

  • Ubuntu 20.04
  • Node 12.13.0
  • npm 6.14.6
  • Webpack 4.42.1
  • Mochapack 2.1.2

Lucidiot avatar Jun 09 '21 08:06 Lucidiot

+1

karlpatrickespiritu avatar Nov 16 '21 01:11 karlpatrickespiritu