Moderate vulnerability alert in transitive dependency (`glob-parent`)
- Dominant language
- TypeScript
- Stars
- 11.3k
- Forks
- 275
- PR merge metrics
- No merged PRs in 30d
Description
There's a moderate vulnerability alert for `glob-parent`, which `tsup` depends on transitively through `chokidar`: https://github.com/advisories/GHSA-cj88-88mr-972w
```shell
> npm install --save-dev tsup && npm audit
added 89 packages, and audited 90 packages in 1s
11 packages are looking for funding
run `npm fund` for details
5 moderate severity vulnerabilities
To address all issues, run:
npm audit fix
Run `npm audit` for details.
# npm audit report
glob-parent <6.0.1
Severity: moderate
glob-parent before 6.0.1 vulnerable to Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-cj88-88mr-972w
fix available via `npm audit fix --force`
Will install tsup@2.1.0, which is a breaking change
node_modules/glob-parent
chokidar >=1.0.0-rc1
Depends on vulnerable versions of glob-parent
node_modules/chokidar
tsup >=3.0.0
Depends on vulnerable versions of chokidar
Depends on vulnerable versions of globby
node_modules/tsup
fast-glob *
Depends on vulnerable versions of glob-parent
node_modules/fast-glob
globby >=8.0.0
Depends on vulnerable versions of fast-glob
node_modules/globby
5 moderate severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
```
Dependabot and `npm audit fix` cannot address this, so I'd love to have an up-to-date way to install `tsup` with a clean `npm audit`. 😃
Contributor guide
Assessment
This issue has not been assessed yet.