Skip to content

Commit

Permalink
Bump debug to ^4.3.1 (#16164)
Browse files Browse the repository at this point in the history
* Fix Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

* Fix yarn process
  • Loading branch information
martinez-hugo committed Dec 8, 2023
1 parent a1da072 commit cce807f
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion packages/babel-traverse/package.json
Expand Up @@ -24,7 +24,7 @@
"@babel/helper-split-export-declaration": "workspace:^",
"@babel/parser": "workspace:^",
"@babel/types": "workspace:^",
"debug": "^4.1.0",
"debug": "^4.3.1",
"globals": "condition:BABEL_8_BREAKING ? ^13.5.0 : ^11.1.0"
},
"devDependencies": {
Expand Down
4 changes: 2 additions & 2 deletions yarn.lock
Expand Up @@ -4304,7 +4304,7 @@ __metadata:
"@babel/helper-split-export-declaration": "workspace:^"
"@babel/parser": "workspace:^"
"@babel/types": "workspace:^"
debug: "npm:^4.1.0"
debug: "npm:^4.3.1"
globals: "condition:BABEL_8_BREAKING ? ^13.5.0 : ^11.1.0"
languageName: unknown
linkType: soft
Expand Down Expand Up @@ -8095,7 +8095,7 @@ __metadata:
languageName: node
linkType: hard

"debug@npm:4, debug@npm:4.3.4, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.2, debug@npm:^4.3.4":
"debug@npm:4, debug@npm:4.3.4, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4":
version: 4.3.4
resolution: "debug@npm:4.3.4"
dependencies:
Expand Down

0 comments on commit cce807f

Please sign in to comment.