aquasecurity / aquasecurity/cloudsploit

Update nodemon to v.2.0.20

Open
#1,553 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
3.8k
Forks
751
Avg merge
11d 9h
Merged PRs (30d)
3

Description

`nodemon` `1.3.5 - 2.0.16 || 2.0.18`
Depends on vulnerable versions of `chokidar` `1.0.0-rc1 - 2.1.8` that depends on vulnerable versions of `glob-parent`
`glob-parent` before `5.1.2` vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
updating `nodemon` to `v.2.0.20` will update its dependency `chokidar` and `glob-parent`

Contributor guide

Open the contributing guide

Research direction

Start by locating the project manifest and lockfile entries for nodemon, then inspect the dependency tree for chokidar and glob-parent. Update nodemon to v2.0.20 and verify that the vulnerable dependency versions are no longer present.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.