Vulnerability in parcel-bundler dependency "serialize-to-js"

[mkaraula]

🐛 bug report

Since today npm audit reports a high vulnerability for my project which uses parcel-bundler. The vulnerability is coming from serialize-to-js which is a dependency of parcel.bundler. serialize-to-js would need y major version update.

npm audit             6.9s  Do 22 Aug 10:02:42 2019

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Denial of Service                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ serialize-to-js                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ parcel-bundler [dev]                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ parcel-bundler > serialize-to-js                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/790                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 high severity vulnerability in 887920 scanned packages

Software	Version(s)
Parcel	1.12.3
Node	v10.16.0
npm/Yarn	6.9.0
Operating System	-

[jonsth131]

Already reported in #3133 and fixed in PR #3451

[mischnic]

Duplicate of #3133

[mkeedlinger]

@mischnic Any chance that this PR (#3451) gets pulled in soon? NPM telling me I have a vulnerability is driving me crazy!

It's a very simple PR (about 15 lines total?), should be super easy.

Thanks!

[DeMoorJasper]

@mkeedlinger the vulnerability was never a valid vulnerability and the PR is merged into master. There will be no update to parcel as it's not a vulnerability and never was as mentioned in the PR. It's the npm security team making a mistake.