search

mswjs / msw

Industry standard API mocking for JavaScript.
https://mswjs.io
MIT License
15.98k stars 520 forks source link

fix(security): update `path-to-regexp` to 6.3.0 #2316

Closed evktalo closed 1 month ago

evktalo commented 1 month ago

Reference: https://security.snyk.io/vuln/SNYK-JS-PATHTOREGEXP-7925106

Background: We have a security alert from Snyk in the project I'm working on and it suggests upgrading to msw 2.0.0 to fix this issue. Looks like migrating is an unknown amount of work. Looks like the suggestion is to migrate from jest to vitest, and vitest is also something new for us (although interesting).

So I thought backporting this fix might be a nice and clean way to hopefully resolve this problem for us.

evktalo commented 1 month ago

I don't think this PR introduces this issue: https://app.codacy.com/gh/mswjs/msw/pull-requests/2316

Maybe this is due to old version of pnmp in use in this legacy branch?

kettanaito commented 1 month ago

@evktalo, if you are referring to the CI, it hasn't run so that failure was about something else. I've triggered it right now, let's see how it goes.

kettanaito commented 1 month ago

Released: v1.3.5 🎉

This has been released in v1.3.5!

Make sure to always update to the latest version (npm i msw@latest) to get the newest features and bug fixes.

Predictable release automation by @ossjs/release.