search

Automattic / vip-cli

The VIP-CLI
https://docs.wpvip.com/vip-cli/
MIT License
59 stars 16 forks source link

fix: CVE-2024-4068 in `braces` #1878

Closed sjinks closed 4 months ago

sjinks commented 4 months ago

Description

This PR fixes a high severity vulnerability in braces (CVE-2024-4068).

Ref: https://github.com/advisories/GHSA-grv7-fg5c-xmjg

braces is a transitive development dependency; therefore, it does not affect our users.

Pull request checklist

New release checklist

Steps to Test

CI must pass.

github-actions[bot] commented 4 months ago

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails

Scanned Manifest Files

sonarcloud[bot] commented 4 months ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

sjinks commented 4 months ago 
$ npm ls braces
@automattic/vip@3.3.1-dev.0 /home/volodymyr/work/vip-cli
├─┬ @babel/cli@7.24.7
│ └─┬ chokidar@3.5.3
│   └── braces@3.0.3
└─┬ @jest/test-sequencer@29.7.0
  └─┬ jest-haste-map@29.7.0
    └─┬ micromatch@4.0.5
      └── braces@3.0.3 deduped