egoist / egoist/tsup

Moderate vulnerability alert in transitive dependency (`glob-parent`)

Open
#672 3 comments 1 reaction 0 assignees View on GitHub
Dominant language
TypeScript
Stars
11.3k
Forks
275
PR merge metrics
No merged PRs in 30d

Description

There's a moderate vulnerability alert for `glob-parent`, which `tsup` depends on transitively through `chokidar`: https://github.com/advisories/GHSA-cj88-88mr-972w

```shell
> npm install --save-dev tsup && npm audit

added 89 packages, and audited 90 packages in 1s

11 packages are looking for funding
run `npm fund` for details

5 moderate severity vulnerabilities

To address all issues, run:
npm audit fix

Run `npm audit` for details.
# npm audit report

glob-parent <6.0.1
Severity: moderate
glob-parent before 6.0.1 vulnerable to Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-cj88-88mr-972w
fix available via `npm audit fix --force`
Will install tsup@2.1.0, which is a breaking change
node_modules/glob-parent
chokidar >=1.0.0-rc1
Depends on vulnerable versions of glob-parent
node_modules/chokidar
tsup >=3.0.0
Depends on vulnerable versions of chokidar
Depends on vulnerable versions of globby
node_modules/tsup
fast-glob *
Depends on vulnerable versions of glob-parent
node_modules/fast-glob
globby >=8.0.0
Depends on vulnerable versions of fast-glob
node_modules/globby

5 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force
```

Dependabot and `npm audit fix` cannot address this, so I'd love to have an up-to-date way to install `tsup` with a clean `npm audit`. 😃

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.