Skip to content

Conversation

@chengfang
Copy link
Collaborator

This PR fixes CVE-2024-45296 by upgrading the indirect dependency react-router/path-to-regexp from 1.8.0 to 1.9.0.

The other usage of path-to-regexp 0.1.10 (via express) is to be addressed by a separate PR that upgrades express, and thus is not changed here.

The dependency after this fix:

gitops-plugin@0.0.1 /Users/cfang/dev/gitops/gitops-console-plugin
├─┬ @openshift-console/dynamic-plugin-sdk-internal@0.0.11
│ └─┬ react-router@5.2.0
│   └── path-to-regexp@1.9.0 deduped
├─┬ react-router@5.3.4
│ └── path-to-regexp@1.9.0
└─┬ webpack-dev-server@4.15.2
  └─┬ express@4.19.2
    └── path-to-regexp@0.1.7

…pgrading path-to-regexp from 1.8.0 to 1.9.0

Signed-off-by: Cheng Fang <cfang@redhat.com>
Copy link
Collaborator

@keithchong keithchong left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@keithchong keithchong merged commit dffca68 into redhat-developer:main Sep 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants