google / google/clasp

glob@10.5.0 - security vulnerabilty warning

Open Beginner friendly
#1,171 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
5.8k
Forks
510
Avg merge
5h 27m
Merged PRs (30d)
1

Description

Hey! A dependency of clasp `glob` looks like it has security vulnerabilities on 10.5. It triggers a warning when installing.

I searched issues and found one for `gemini-cli` but none for `clasp`

https://github.com/google-gemini/gemini-cli/issues/18327

Should this project look at bumping this version? It appears the vulns are for versions <10.5 but this warning is confusing and alarming at first look.

```
╭─admin@admins-MacBook-Pro-2 ~/Documents/github
╰─➤ npm install @google/clasp -g
npm warn deprecated node-domexception@1.0.0: Use your platform's native DOMException instead
npm warn deprecated glob@10.5.0: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me

added 295 packages in 9s

105 packages are looking for funding
run `npm fund` for details
```

Contributor guide

Open the contributing guide

Research direction

Start by inspecting clasp's dependency manifests to find which package brings in glob@10.5.0, then reproduce the warning with `npm install @google/clasp -g`. Done means determining whether the dependency can be updated and confirming installation no longer produces the confusing glob vulnerability warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, typescript
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
64/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.