search

electron / get

Download Electron release artifacts
https://npm.im/@electron/get
MIT License
337 stars 106 forks source link

Upgrade `got` dependency to 12.5.0 or higher to fix security vulnerability #244

Closed nabchar closed 1 year ago

nabchar commented 1 year ago

Snyk lists http-cache-semantics as having a Regular Expression Denial of Service (ReDoS) security vulnerability for any versions prior to 4.1.1. Read here for more info.

In this package, the dependency on "got": "^11.8.5" internally has a dependency on "cacheable-request": "^7.0.2", which in turn has a dependency on "http-cache-semantics": "^4.0.0" -- which is tied to a minor version that has the security vulnerability mentioned above.

erickzhao commented 1 year ago

Duplicate of https://github.com/electron/get/issues/242

"http-cache-semantics": "^4.0.0" is not tied to the vulnerable version. 4.1.1 is compliant with ^4.0.0.