glob@10.5.0 - security vulnerabilty warning
- Dominant language
- TypeScript
- Stars
- 5.8k
- Forks
- 510
- Avg merge
- 5h 27m
- Merged PRs (30d)
- 1
Description
Hey! A dependency of clasp `glob` looks like it has security vulnerabilities on 10.5. It triggers a warning when installing.
I searched issues and found one for `gemini-cli` but none for `clasp`
https://github.com/google-gemini/gemini-cli/issues/18327
Should this project look at bumping this version? It appears the vulns are for versions <10.5 but this warning is confusing and alarming at first look.
```
╭─admin@admins-MacBook-Pro-2 ~/Documents/github
╰─➤ npm install @google/clasp -g
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
added 295 packages in 9s
105 packages are looking for funding
run `npm fund` for details
```
Contributor guide
Research direction
Start by inspecting clasp's dependency manifests to find which package brings in glob@10.5.0, then reproduce the warning with `npm install @google/clasp -g`. Done means determining whether the dependency can be updated and confirming installation no longer produces the confusing glob vulnerability warning.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100