postmanlabs / postmanlabs/postman-code-generators
[Security] semver (dependency) vulnerable to Regular Expression Denial of Service
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 381
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
This package is dependent on an old version of postman-collection which is dependent on a vulnerable semver version.
To Reproduce
When running npm audit the following output appears:
semver 7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install postman-code-generators@1.0.2, which is a breaking change
node_modules/postman-collection/node_modules/semver
postman-collection 3.6.0-beta.1 - 4.1.7
Depends on vulnerable versions of semver
node_modules/postman-collection
postman-code-generators >=1.1.0
Depends on vulnerable versions of postman-collection
node_modules/postman-code-generators
3 moderate severity vulnerabilities
Fix suggestion
Update postman-collection to version 4.4.0.
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running npm audit and inspect the dependency declarations for postman-collection and postman-code-generators. Update postman-collection to 4.4.0, then verify that the dependency tree no longer includes the vulnerable semver versions and that the reported breaking change does not disrupt the package.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100