Vulnerable Dependency - braces

[madhavsarpalJG]

• chokidar uses braces which has a vulnerability of 7.5, CVE-2024-4068. Can we use an alternative or are waiting for a fix from them?

[paulmillr]

1. It is not a real vulnerability. CVE rating 7.5 is nonsense. More like 2.5
2. They can’t even produce a working exploit. Some folks have found some slowdown for 100 million braces, which is nonsense. Would you personally build such regex?
3. There are no other packages to switch. They are either esm only, or very slow, or potentially dangerous with unknown maintainers. They can upload malware to chokidar users
4. See thread for the context. We are waiting to either retract the cve, fix the issue, etc It is another shit that got cve https://github.com/micromatch/micromatch/issues/243

[thomashohn]

So are you planing on doing a release 3.6.1 with braces 3.0.3?

[paulmillr]

@thomashohn no.

Is there something in "we are using version ranges" phrase you don't understand?

[thomashohn]

No sir