Closed s100 closed 1 year ago
patch-package depends on semver@^5.6.0, which is vulnerable to CVE-2022-25883. This can be fixed by upgrading to semver@7.5.3 or later.
patch-package
semver@^5.6.0
semver@7.5.3
Noting that #466 does not fix this, since that only bumps the semver version to 7.0.0, and not 7.5.3 or above.
semver
Fixed in patch-package@7.0.1.
patch-package@7.0.1
patch-package
depends onsemver@^5.6.0
, which is vulnerable to CVE-2022-25883. This can be fixed by upgrading tosemver@7.5.3
or later.