gruntjs / gruntjs/grunt

Avoid unresolved vulnerability in "inflight" via glob 7

Open
#1,791 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
12.2k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

Hi,

While using grunt@1.6.1, we ran a snyk test and found security vulnerabilities.

```
✗ Medium severity vulnerability found in inflight
Description: Missing Release of Resource after Effective Lifetime
Info: https://security.snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
Introduced through: glob@7.1.7
From: glob@7.1.7 > inflight@1.0.6
```

Thanks for developing grunt!

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the repository's dependency manifests to trace how glob@7.1.7 and inflight@1.0.6 enter grunt@1.6.1, then run the reported Snyk check. Done means the dependency path no longer introduces the cited SNYK-JS-INFLIGHT-6095116 vulnerability without breaking the existing dependency setup.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.