Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Vulnerability in `url-regex` indirect dependency

See original GitHub issue

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ url-regex                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ fomantic-ui                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ fomantic-ui > gulp-concat-css > rework-import > url-regex    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1550                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

All these dependencies look pretty unmaintained to me so I think the best course of action would be to look for alternatives to gulp-concat-css.

Issue Analytics

State:
Created 3 years ago
Reactions:9
Comments:10 (2 by maintainers)

Top GitHub Comments

2reactions

phiberbercommented, Feb 2, 2021

One question: do you have an estimated date for the attention of this issue?

Whenever somebody volunteers to maintain new packages or rewrite the dependency code to be directly included in the core

There’s a branch that can be used that uses the URL regex safe dependency. I can create a PR using it if you want me to.

https://github.com/Cj-bc/gulp-concat-css/tree/use_url-regex-safe_rework-import

2reactions

gilquintanacommented, Oct 20, 2020

One question: do you have an estimated date for the attencion of this issue?