Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Depends on vulnerable versions of strip-ansi #5

Closed
waddles opened this issue Oct 18, 2021 · 1 comment
Closed

Depends on vulnerable versions of strip-ansi #5

waddles opened this issue Oct 18, 2021 · 1 comment

Comments

@waddles
Copy link

waddles commented Oct 18, 2021

Getting this from npm audit fix:

# npm audit report

ansi-regex  >2.1.1 <5.0.1
Severity: moderate
 Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
fix available via `npm audit fix --force`
Will install @soda/[email protected], which is a breaking change
node_modules/ansi-regex
  strip-ansi  4.0.0 - 5.2.0
  Depends on vulnerable versions of ansi-regex
  node_modules/strip-ansi
    @soda/friendly-errors-webpack-plugin  >=1.8.0
    Depends on vulnerable versions of strip-ansi
    node_modules/@soda/friendly-errors-webpack-plugin

I think it just needs strip-ansi dependency updated to ^6 but haven't tested.
@mriedem
Copy link

mriedem commented Oct 21, 2021 •
edited
Loading

I think string-width needs updating to >= 4.2.3 also:

https://github.com/sodatea/friendly-errors-webpack-plugin/blob/master/package.json#L71

sindresorhus/string-width@e7a2755

mriedem added a commit to mriedem/friendly-errors-webpack-plugin that referenced this issue Oct 21, 2021
@mriedem
Update dependencies for ansi-regex CVE-2021-3807
1914474 
This updates string-width and strip-ansi to versions that
require ansi-regex 5.0.1 for CVE-2021-3807 [1][2].

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-3807
[2] GHSA-93q8-gq69-wqmw

Closes haoqunjiang#5
@mriedem mriedem mentioned this issue Oct 21, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update dependencies for ansi-regex CVE-2021-3807 mriedem/friendly-errors-webpack-plugin
2 participants
@waddles @mriedem