aquasecurity / aquasecurity/cloudsploit
Update nodemon to v.2.0.20
- Dominant language
- JavaScript
- Stars
- 3.8k
- Forks
- 751
- Avg merge
- 11d 9h
- Merged PRs (30d)
- 3
Description
`nodemon` `1.3.5 - 2.0.16 || 2.0.18`
Depends on vulnerable versions of `chokidar` `1.0.0-rc1 - 2.1.8` that depends on vulnerable versions of `glob-parent`
`glob-parent` before `5.1.2` vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
updating `nodemon` to `v.2.0.20` will update its dependency `chokidar` and `glob-parent`
Contributor guide
Research direction
Start by locating the project manifest and lockfile entries for nodemon, then inspect the dependency tree for chokidar and glob-parent. Update nodemon to v2.0.20 and verify that the vulnerable dependency versions are no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100