Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: Update find-node-modules to resolve braces vulnerability #66

Closed
G-Rath opened this issue May 14, 2019 · 1 comment · Fixed by #67
Closed

Security: Update find-node-modules to resolve braces vulnerability #66

G-Rath opened this issue May 14, 2019 · 1 comment · Fixed by #67

Comments

@G-Rath
Copy link

G-Rath commented May 14, 2019

Low Regular Expression Denial of Service

Package braces

Patched in >=2.3.1

Dependency of browserify-css [dev]

Path browserify-css > find-node-modules > findup-sync >
micromatch > braces

More info https://npmjs.com/advisories/786

I have made an comment requesting a new version of [email protected] be released with an update to the braces dependency, which might happen and thus resolve this.

However, ideally browserify-css should update find-node-modules to v2.0.0, to resolve this security vulnerability.

@AsinusRex
Copy link

Also hoping for a dependency version bump up to get rid of the vulnerability. Doing it by hand introduces a whole new process to deployment.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants