Avoid unresolved vulnerability in "inflight" via glob 7
- Dominant language
- JavaScript
- Stars
- 12.2k
- Forks
- 1.5k
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
While using grunt@1.6.1, we ran a snyk test and found security vulnerabilities.
```
✗ Medium severity vulnerability found in inflight
Description: Missing Release of Resource after Effective Lifetime
Info: https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
Introduced through: glob@7.1.7
From: glob@7.1.7 > inflight@1.0.6
```
Thanks for developing grunt!
Contributor guide
Research direction
Start by inspecting the repository's dependency manifests to trace how glob@7.1.7 and inflight@1.0.6 enter grunt@1.6.1, then run the reported Snyk check. Done means the dependency path no longer introduces the cited SNYK-JS-INFLIGHT-6095116 vulnerability without breaking the existing dependency setup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100