[Security]: linkify-it 5.0.0 in pnpm-lock.yaml is affected by ReDoS advisories (fixed in 5.0.2)
- Vorherrschende Sprache
- Rust
- Sterne
- 2.2k
- Forks
- 229
- Ø Merge
- 2 Std. 46 Min.
- Gemergte PRs (30 T.)
- 577
Beschreibung
Summary: pnpm-lock.yaml resolves linkify-it 5.0.0 (a markdown-it dependency), which is covered by the ReDoS advisories affecting the 5.0.x line below 5.0.2.
Area: Dependencies (Web UI)
Reproduction or evidence: `pnpm-lock.yaml` contains `linkify-it@5.0.0` reached through markdown-it's dependency graph; `pnpm audit` flags linkify-it < 5.0.2 for ReDoS. The override pins 5.0.2 and the regenerated lock resolves the patched release at the markdown-it consumption point.
Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main), pnpm 10.15.0.
Beitragsleitfaden
Rechercherichtung
Start with pnpm-lock.yaml and the dependency path through markdown-it; inspect the existing override and run pnpm audit using pnpm 10.15.0. Done means the regenerated lockfile resolves linkify-it at 5.0.2 or newer and the reported ReDoS advisory is no longer present.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- javascript
- Bereich
- security, web-dev
- Issue-Typ
- Bug
- Schwierigkeit
- 2/5
- Geschätzter Aufwand
- 1-3 Stunden
- Aktivitätsstatus
- Aktiv
- Klarheit
- Klar beschrieben
- Anfängerfreundlichkeit
- 82/100