npm reports severity vulnerabilities in `glob-stream` version

Drogglbecher commented 3 years ago

When adding the latest version of parallel-prettier in the package-json of my project, npm tells me the following while doing npm audit:

# npm audit report

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
No fix available
node_modules/glob-stream/node_modules/glob-parent
  glob-stream  >=5.3.0
  Depends on vulnerable versions of glob-parent
  node_modules/glob-stream
    @mixer/parallel-prettier  *
    Depends on vulnerable versions of glob-stream
    node_modules/@mixer/parallel-prettier

3 moderate severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

trivikr commented 2 years ago

The dependency on glob-stream needs to be bumped which gets vulnerable glob-parent.

The latest version is glob-stream@7 as of June 2022, and parallel-prettier depends on the latest minor version of v6 https://github.com/microsoft/parallel-prettier/blob/79515f9f7daf568133cb05078c38cc20c4789921/package.json#L37

The dependency glob-stream@7 bumped their dependency on glob-parent from v3 to v6. gulpjs/glob-stream@v6.1.0...v7.0.0#diff-7ae45ad102

trivikr commented 2 years ago

Thanks for merging the PR.

Is v2.0.3 or v2.1.0 release planned to publish it?

trivikr commented 2 years ago

Is v2.0.3 or v2.1.0 release planned to publish it?

The fix was released in v2.0.3

microsoft / parallel-prettier

npm reports severity vulnerabilities in `glob-stream` version #14