Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump tsconfig-paths dependency to 4.1.2 to fix high severity vulnerability #2635

Closed
sspenst opened this issue Jan 2, 2023 · 2 comments
Closed

Comments

@sspenst
Copy link

sspenst commented Jan 2, 2023

json5 high severity vulnerability described here GHSA-9c47-m6qq-7p4h

tsconfig-paths has updated their dependency here dividab/tsconfig-paths#232

Requesting a new eslint-plugin-import version that updates the tsconfig-paths dependency to v4.1.2

@sspenst
Copy link
Author

sspenst commented Jan 2, 2023

Found there was already a lot of discussion here on this: #2447

Will wait for github/advisory-database#1541 to get merged

@sspenst sspenst closed this as not planned Won't fix, can't repro, duplicate, stale Jan 2, 2023
@ljharb
Copy link
Member

ljharb commented Jan 2, 2023

Indeed, json5 v1.0.2 has already been updated with this fix, and either way, it's not a valid vulnerability.

As is the case with almost every JS CVE, the best course of action is to do nothing until the ecosystem fixes it for you.

This is a duplicate of #2625; a duplicate of #2628; a duplicate of #2626; a duplicate of #2627; a duplicate of #2631; a duplicate of #2632; a duplicate of #2634.

Please stop filing issues about a vulnerability on "not the vulnerable package", it doesn't help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants