Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

glob-parent before 6.0.1 vulnerable to Regular Expression Denial of Service (ReDoS) npm audit error #1748

Closed
Waujito opened this issue Jul 19, 2022 · 1 comment

Comments

@Waujito
Copy link

Waujito commented Jul 19, 2022

Today i got glob-parent error on npm audit fix.

# npm audit report

glob-parent  <6.0.1
Severity: moderate
glob-parent before 6.0.1 vulnerable to Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-cj88-88mr-972w
fix available via `npm audit fix --force`
Will install sass@1.5.1, which is a breaking change
node_modules/chokidar/node_modules/glob-parent
  chokidar  >=1.0.0-rc1
  Depends on vulnerable versions of glob-parent
  node_modules/chokidar
    sass  >=1.6.0
    Depends on vulnerable versions of chokidar
    node_modules/sass

3 moderate severity vulnerabilities

Is this error important?
npm audit fix --force downgrades sass package to version 1.5.1

@nex3
Copy link
Contributor

nex3 commented Aug 2, 2022

This is apparently an incorrect report: paulmillr/chokidar#1191. In any case, we can't do anything about it unless Chokidar does, since we only depend on this transitively through Chokidar.

@nex3 nex3 closed this as not planned Won't fix, can't repro, duplicate, stale Aug 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants