Dependency: Bump path-to-regexp in v4 to fix security vulnerability.

[pranshuchittora]

Bump dep path-to-regexp to fix GHSA-9wv6-86v2-598j

https://github.com/expressjs/express/blob/4.x/package.json#L50

[wesleytodd]

This was released in expree@4.20.0

[jacquesg]

@wesleytodd I don't believe it has been fixed. The version is still set to 0.1.10

[krzysdz]

0.1.10 is the version that fixes the vulnerability.

See the advisory for more details: GHSA-9wv6-86v2-598j

[jacquesg]

Indeed, apologies. Seems like the scanner I'm using doesn't know this.

[wesleytodd]

Is the scanner Snyk? Because we have asked them to change theirs here

[krzysdz]

Is the scanner Snyk? Because we have asked them to change theirs here

Snyk has already updated their advisory, listing 0.1.10 as not vulnerable.

How to fix?

Upgrade path-to-regexp to version 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0 or higher.

With the added note recommending 8.0.0 if possible and warning of custom regular expressions:

Note: While the 8.0.0 release has completely eliminated the vulnerable functionality, prior versions that have received the patch to mitigate backtracking may still be vulnerable if custom regular expressions are used. So it is strongly recommended for regular expression input to be controlled to avoid malicious performance degradation in those versions. This behavior is enforced as of version 7.1.0 via the strict option, which returns an error if a dangerous regular expression is detected.

[jacquesg]

Is the scanner Snyk? Because we have asked them to change theirs here

We're using Aikido, they seem to have fixed it after I notified them.