Security: diff dependency vulnerable to DoS (GHSA-73rr-hh4g-fpgx)
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 3k
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
Description
Hi,
I noticed that uvu depends on the diff package with the version range: "diff": "^5.0.0"
A recent GitHub Security Advisory reports a Denial of Service vulnerability in diff < 8.0.3
https://github.com/advisories/GHSA-73rr-hh4g-fpgx
the above issue is now being flagged by npm audit and other dependency security scanners for projects that depend on uvu.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by checking uvu's dependency declaration for diff and compare the supported version range with GHSA-73rr-hh4g-fpgx; done means the vulnerable range is no longer installed and npm audit or equivalent scanners stop reporting the advisory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, testing-qa
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100