Could you help update packages to fix the vulnerability introduced by package normalize-url ?

[paimon0715]

Hi @IonicaBizau ,there is a high severity vulnerability introduced by package normalize-url

Issue

1 vulnerability (high severity) is introduced in git-up:
Vulnerability CVE-2021-33502 (high severity) is detected in package normalize-url (versions: <4.5.1,>=5.0.0 <5.3.1,>=6.0.0 <6.0.1): https://snyk.io/vuln/SNYK-JS-NORMALIZEURL-1296539

The above vulnerable package is referenced by git-up via:
git-up@4.0.2 ➔ parse-url@5.0.6 ➔ normalize-url@4.5.0

Solution

Since git-up@4.0.* is transitively referenced by 2845 downstream projects (e.g., git-url-parse 11.4.4 (latest version), lerna 4.0.0 (latest version), @lerna/version 4.0.0 (latest version), @lerna/publish 4.0.0 (latest version), @lerna/github-client 4.0.0 (latest version))

If git-up@4.0.* removes the vulnerable package from the above version, then its fixed version can help downstream users decrease their pain.

Could you help update packages in this version?

Fixing suggestions

In git-up@4.0.*, you can kindly perform the following upgrades (not crossing their major versions):
parse-url ^5.0.0 ➔ 5.0.3;

Note:
parse-url 5.0.3 directly depends on normalize-url@6.1.0(a vulnerability CVE-2021-33502 patched version)

Thanks for your contributions to downstream users !

Best regards,
Paimon

[paimon0715]

A large number of active downstream users transitively use the lower version of git-up(@4.0.* ) (introduced vulnerablity) via unmaintained packages (cannot update their dependencies). If git-up@4.0.* can fix the issue, the vulnerable patches can be automatically propagated into the active downstream projects.

[IonicaBizau]

@paimon0715 It is a little bit tricky how to solve this. Because if we introduce a patch for the vulnerability, that means that the module won't work on Safari too... However I think it is better to fix the vulnerability.

[IonicaBizau]

🚀 Published git-up@4.0.4 depending on parse-url@6.0.0 (which is not vulnerable, but will not work on Safari)...