fix: address `express` and `path-to-regexp` vulnerabilities

mswjs / msw

Industry standard API mocking for JavaScript.

https://mswjs.io

MIT License

15.97k stars 519 forks source link

Closed markmssd closed 2 months ago

markmssd commented 2 months ago

path-to-regexp fix has been backported to v6.3.0 too (as pointed in https://github.com/mswjs/msw/issues/2270#issuecomment-2345825437). We just need to wait for the audit to get updated and acknowledge it's fixed there too.

express is only used in specs, thus it's not a breaking change to upgrade to v5.

Ideally, we'd upgrade path-to-regexp to latest v8, but I couldn't get there. I can try again in a few days though.

ekaitzht commented 2 months ago

Hello, should not be this kind of PR to update the semver minor? from 2.4.7 5 to 2.4.8? 🤔 cc @kettanaito @markmssd

kettanaito commented 2 months ago

@ekaitzht, you aren't consuming neither express nor path-to-regexp directly. There are no changes to the MSW's behavior for you. This is a fix.

kettanaito commented 2 months ago

This has been released in v2.4.8!

Make sure to always update to the latest version (npm i msw@latest) to get the newest features and bug fixes.

Predictable release automation by @ossjs/release.