npm install warns to update minimatch to avoid RegExp DoS issue

[sudheesh001]

$ npm install -g jake
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
C:\Users\susingan\AppData\Roaming\npm\jake -> C:\Users\susingan\AppData\Roaming\npm\node_modules\jake\bin\cli.js
C:\Users\susingan\AppData\Roaming\npm
`-- [email protected]
  +-- [email protected]
  +-- [email protected]
  | +-- [email protected]
  | +-- [email protected]
  | `-- [email protected]
  +-- [email protected]
  | +-- [email protected]
  | `-- [email protected]
  +-- [email protected]
  | +-- [email protected]
  | `-- [email protected]
  `-- [email protected]

[welearnednothing]

Does anyone know if updating to Minimatch 3.x will introduce any breaking changes? The versions is use are pretty old and I don't know if the project is following semantic versioning.

On Aug 17, 2016, at 10:23 PM, Sudheesh Singanamalla [email protected] wrote:

$ npm install -g jake
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated [email protected]: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
C:\Users\susingan\AppData\Roaming\npm\jake -> C:\Users\susingan\AppData\Roaming\npm\node_modules\jake\bin\cli.js
C:\Users\susingan\AppData\Roaming\npm
-- [email protected] +-- [email protected] +-- [email protected] | +-- [email protected] | +-- [email protected] |-- [email protected]
+-- [email protected]
| +-- [email protected]
| -- [email protected] +-- [email protected] | +-- [email protected] |-- [email protected]
`-- [email protected]

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[mde]

The change from node-glob, (which was a C lib) to minimatch wasn't all that traumatic. And we do have pretty good test coverage. We should know pretty quickly if there is major breakage. Would love a PR that upgrades this!

[evansjarom11]

This vulnerability still exists. Please update dependency to 3.0.5 or higher. See: CVE-2022-3517