Vulnerable downstream dependency

[jdforsythe]

Welcome to the issues section if it's your first time!

Before creating an issue, please be sure to:

• Checkout to the latest version, including submodules
• Try to find an isolated way to reproduce the behavior
• Fill in all the blanks in the most specific way you can

Steps to reproduce

Expected behaviour

Tell us what should happen

Actual behaviour

Tell us what happens instead

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ semver vulnerable to Regular Expression Denial of Service    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ semver                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=7.5.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ argon2                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ argon2 > @mapbox/node-pre-gyp > make-dir > semver            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1092310                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

Environment

Operating system:

Node version:

Compiler version:

[AkiraMiyakoda]

We're waiting for @mapbox/node-pre-gyp to update its dependency. (mapbox/node-pre-gyp#685)
make-dir has already been updated, so you can add this to your package.json as an interim measure.

"overrides": {
  "make-dir": "^4.0.0"
}

[jdforsythe]

@AkiraMiyakoda @mapbox/node-pre-gyp v1.0.11 was just published with the fix

mapbox/node-pre-gyp#685
mapbox/node-pre-gyp#691
https://github.com/mapbox/node-pre-gyp/releases/tag/v1.0.11
https://www.npmjs.com/package/@mapbox/node-pre-gyp/v/1.0.11

[ranisalt]

Feel free to open a PR updating the dependency before dependabot does it :)

[jdforsythe]

Feel free to open a PR updating the dependency before dependabot does it :)

Done. #383

[jdforsythe]

@ranisalt is there an upcoming release that will contain this change?

[ranisalt]

@jdforsythe releasing v0.31.0 with updated dependencies now.