Security advice semver

[NormandoHall]

https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

nodemon  1.4.10-alpha.1 - 1.4.10-alpha.3 || >=1.14.10
  Depends on vulnerable versions of semver
  Depends on vulnerable versions of simple-update-notifier

[wellwelwel]

A lot of packages use semver in versions earlier than 7.5.2.

---

I solved it temporally by:

YARN

package.json

"resolutions": {
"**/semver": "^7.5.2"
}

- Then
```sh
yarn install

• Checking

  yarn audit

---

NPM

package.json

"resolutions": {
"semver": "7.5.2"
}

• Then

  npm i -D npm-force-resolutions
  npx npm-force-resolutions

• Checking

  npm audit

[fluentmoheshwar]

A lot of packages use semver in versions earlier than 7.5.2.

I solved it temporally by:

YARN

package.json

"resolutions": {
  "**/semver": "^7.5.2"
}

• Then

yarn install

• Checking

yarn audit

NPM

package.json

"resolutions": {
  "semver": "7.5.2"
}

• Then

npm i -D npm-force-resolutions
npx npm-force-resolutions

• Checking

npm audit

you could also use (doesn't require npm-force-resolutions):

"overrides": {
        "semver": "7.5.2"
 }

[joaomoreno]

A better approach:

    "overrides": {
        "nodemon": {
            "simple-update-notifier": {
                "semver": "^7.5.2"
            }
        }
    }

[zang3tsu88]

A better approach:

  "overrides": {
      "nodemon": {
          "simple-update-notifier": {
              "semver": "^7.5.2"
          }
      }
  }

Thanks, but this one doesnt fix the issue. Out of 3 moderate vulnerabilities it leaves 2. The previous one helped.

[github-actions[bot]]

:tada: This issue has been resolved in version 3.0.0 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: