search

mrmlnc / fast-glob

:rocket: It's a very fast and efficient glob library for Node.js
MIT License
2.51k stars 108 forks source link

New fast-glob version required due to dependency CVE in micromatch #443

Closed jimjaeger closed 2 months ago

jimjaeger commented 3 months ago

Hello,

could you please provide a rebuild / new version from fast-glob to bump to new micromatch dependency version 4.0.6

fast-glob 3.3.2 defines a dependency to micromatch. ├─┬ fast-glob@3.3.2 │ │ ├── @nodelib/fs.stat@2.0.5 │ │ ├── @nodelib/fs.walk@1.2.8 deduped │ │ ├─┬ glob-parent@5.1.2 │ │ │ └── is-glob@4.0.3 deduped │ │ ├── merge2@1.4.1 │ │ └─┬ micromatch@4.0.5

How to fix? Upgrade micromatch to version 4.0.6 or higher. See: https://security.snyk.io/vuln/SNYK-JS-MICROMATCH-6838728

Thanks.

hrgondaliya commented 3 months ago

When can we expect a new version of the "fast-glob" with the fix?

indera commented 3 months ago

Here is an MR to fix this issue https://github.com/mrmlnc/fast-glob/pull/444

indera commented 3 months ago

We will probably have to fork this repo, not sure who are the maintainers.