semantic-release / semantic-release/gitlab-config
Current release depends on package with know vulnerability
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 60
- Forks
- 20
- PR merge metrics
- No merged PRs in 30d
Description
Snyk reports that version 14.0.1 indirectly depends on glob 10.4.5, which has a known vulnerability:
https://www.cve.org/CVERecord?id=CVE-2025-64756
https://security.snyk.io/vuln/SNYK-JS-GLOB-14040952
The path to glob:
@semantic-release/gitlab-config@14.0.1 › @semantic-release/npm@12.0.2 › npm@10.9.4 › glob@10.4.5
Bumping @semantic-release/npm to ^13.0.0 will allow it to use npm@11.6.x, which depends on glob@13.
It may be related to https://github.com/semantic-release/gitlab-config/pull/332
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the dependency manifest for @semantic-release/gitlab-config and inspect the dependency tree described in the issue. Update @semantic-release/npm to ^13.0.0, then verify that the resolved npm version uses glob 13 and that the reported vulnerability is no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- release, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100