Using vulnerable version of path-to-regexp - Githubissues

nestjs / serve-static

Serve static websites (SPA's) using Nest framework (node.js) 🥦

https://nestjs.com/

MIT License

463 stars 60 forks source link

Using vulnerable version of path-to-regexp #1496

Closed sh1l0n closed 3 weeks ago

sh1l0n commented 1 month ago

Is there an existing issue for this?

[X] I have searched the existing issues

Current behavior

The path-to-regex depency is too odd around 10 years ago

Accoding to https://github.com/advisories/GHSA-9wv6-86v2-598j should use recommended versions

Minimum reproduction code

https://github.com/advisories/GHSA-9wv6-86v2-598j

Steps to reproduce

No response

Expected behavior

Upgrade to 1.9.0 (as minimum)

Package version

4.0.2

NestJS version

10.4.5

Node.js version

20.18.0

In which operating systems have you tested?

[X] macOS
[ ] Windows
[ ] Linux

Other

No response

kamilmysliwiec commented 3 weeks ago

https://github.com/nestjs/serve-static/pull/1454#issuecomment-2426269793