search

cucumber / cucumber-js

Cucumber for JavaScript
https://cucumber.io
MIT License
5.02k stars 1.09k forks source link

Veracode security issue for glob@7.2.3 -> inflight@1.0.6 #2329

Closed bugrauluyurt closed 10 months ago

bugrauluyurt commented 10 months ago

👓 What did you see?

@cucumber/cucumber@9.5.1 depends on glob@7.2.3 package which also has a vulnerable dependency 'infligh@1.0.6'. As per 'https://github.com/isaacs/inflight/issues/18' vulnerable dependency is being fixed in glob@9.0.0.

✅ What did you expect to see?

Cucumber lib using an updated version of glob. > 9.0.0 without any vulnerabilities

📦 Which tool/library version are you using?

9.5.1

🔬 How could we reproduce it?

Steps to reproduce the behavior:

  1. Install @cucumber/cucumber@9.5.19.5.1
  2. npm list inflight
  3. Observe that cucumber is dependent is glob@7.2.3 -> inflight@1.0.6