search

uhop / node-re2

node.js bindings for RE2: fast, safe alternative to backtracking regular expression engines.
Other
489 stars 53 forks source link

re2 package has vulnerability dependencies #113

Closed stasharosh closed 2 years ago

stasharosh commented 2 years ago

Please update ansi-regex cause it's already outdated and has vulnerability phone_pool_—_-zsh_—_198×54 t phone_pool_—_-zsh_—_198×54 y

uhop commented 2 years ago

This is a dependency of node-gyp, which is used to compile the source, not to process a user input. re2 doesn’t call ansi-regex anywhere.

stasharosh commented 2 years ago

Ok, understood it, thanks for answer. So, could you please update node-gyp package in your package dependencies? Or I should raise this to them before?

uhop commented 2 years ago

I'll try to upgrade node-gyp.

stasharosh commented 2 years ago

Thank you very much.

uhop commented 2 years ago

The deps are updated and the warning has gone. It will be published with 1.17.0.