Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Security issue in ansi-regex dependency (via yargs)

See original GitHub issue

Currently it is impossible to install showdown without pulling in a security vulnerability, because showdown has a tightly versioned dependency on yargs which pulls in a vulnerable ansi-regex.

The security advisory is:

https://github.com/advisories/GHSA-93q8-gq69-wqmw

Issue Analytics

State:
Created 2 years ago
Reactions:6
Comments:8 (2 by maintainers)

Top GitHub Comments

1reaction

wbtcommented, Jan 7, 2022

With some ambitious plans, it looks like the 2.0.0 release could be quite a ways away. Might we be able to just apply the above commits on the last release tag and publish a patch update that handles the vulnerabilities / audit failures before then?

0reactions

wbtcommented, Jan 10, 2022

I’ve added a PR which should fix this. It drops support for node v6 and v8, so technically it should probably go out as 2.0.0, with the next big breaking release now being planned going out in n months as 3.0.0. This commit bumps the version number and adds changelog notes you can copy (the source of) that and paste it right into the release notes.

Merge, release on Github, publish to npm, and this issue is solved. Thanks for your work!

Top Results From Across the Web

yargs-interactive@1.1.1 vulnerabilities - Snyk

Overview. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns [[\\]()#;?]* and (?

Fixing security vulnerabilities in npm dependencies in less ...

This vulnerability could have caused a Regular Expression Denial of Service ... That solves the dependency issues which can not be updated using...

How to update nested package ansi-regex for node-sass ...

1) with no other dependencies still results in the vulnerable ansi-regex being installed. So you'd have to engage in some special shenanigans ...

@at-scale/mock-react-components>1.3.3>nyc>yargs | npm | Open ...

@at-scale/mock-react-components>1.3.3>nyc>yargs · Security Advisories · Licenses · Dependencies · Dependents.

[Security] Update yarn dependencies to fix security issues

Our javascript dependencies have security updates, we should apply them. This is not a private security issue because the vulnerabilities ...