search

nicolo-ribaudo / chokidar-2

A wrapper around chokidar@2 to be able to specify both @2 and @3 as dependencies
1 stars 3 forks source link

glob-parent CVE #3

Closed stefan-squareweave closed 3 years ago

stefan-squareweave commented 3 years ago

There's a new CVE open on glob-parent < 5.1.2 . This package depends on ^3.1.0 currently and so it gets flagged by npm audit and the like.

This issue would be to update the semver matcher to include the 5.1.x series.

nicolo-ribaudo commented 3 years ago

I assume you are using a Node.js version higher than 6. In that case the CVE doesn't affect you and you can safely ignore the warning: in Node.js >= 8, Babel doesn't use this package but uses chokidar@3 directly.

If you are still using Node.js 6, I highly recommend updating to a more recent Node.js version.

nicolo-ribaudo commented 3 years ago

I'm closing this in favour of #5, since there is more discussion there.