postmanlabs / postmanlabs/postman-code-generators

[Security] semver (dependency) vulnerable to Regular Expression Denial of Service

Open
#733 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
1k
Forks
381
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
This package is dependent on an old version of postman-collection which is dependent on a vulnerable semver version.

To Reproduce
When running npm audit the following output appears:

semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
Will install postman-code-generators@1.0.2, which is a breaking change
node_modules/postman-collection/node_modules/semver
  postman-collection  3.6.0-beta.1 - 4.1.7
  Depends on vulnerable versions of semver
  node_modules/postman-collection
    postman-code-generators  >=1.1.0
    Depends on vulnerable versions of postman-collection
    node_modules/postman-code-generators

3 moderate severity vulnerabilities

Fix suggestion
Update postman-collection to version 4.4.0.

Additional context

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running npm audit and inspect the dependency declarations for postman-collection and postman-code-generators. Update postman-collection to 4.4.0, then verify that the dependency tree no longer includes the vulnerable semver versions and that the reported breaking change does not disrupt the package.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
security, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.