Should upgrade the meow to latest version to fix the security issue CVE-2022-25883?
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 674
- Forks
- 101
- PR merge metrics
- No merged PRs in 30d
Description
Looks `MapBox polyline` depends on `meow` which has dependency on `normalize-package-data` and `semver`.
But the latest `MapBox polyline` is referencing the `semver@5.7.2` which has CVE-2022-25883 security issue.
> Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Could you please help to upgrade the `meow` to latest? Thanks.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the MapBox polyline dependency metadata and the meow dependency chain through normalize-package-data and semver. Confirm how the current semver@5.7.2 is selected and identify the dependency update needed to reach a non-vulnerable semver version. Done means the dependency chain no longer resolves to the vulnerable version and the project's existing checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100