A new severe vulnerability has been found in json5 < 2.2.2
The version os tsconfig-paths that this plugin uses needs updating. 4.1.1 is the latest release which will update json5 to the latest version too. But this package requires 3.14.1
Is there any change of an update ASAP please?
This package is being used by a NuxtJS eslint config plugin I am using and should there be breaking changes or a major semver release as a result I will raise an issue there to get that updated too.
I'll raise an issue there so the maintainers can track this vulnerability.
This is my npm audit report:
json5 <2.2.2
Severity: high
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
fix available via `npm audit fix --force`
Will install @nuxtjs/eslint-config-typescript@6.0.1, which is a breaking change
node_modules/tsconfig-paths/node_modules/json5
tsconfig-paths 3.5.0 - 3.9.0 || 3.11.0 - 3.14.1
Depends on vulnerable versions of json5
node_modules/tsconfig-paths
eslint-import-resolver-typescript 2.6.0-beta - 2.7.1
Depends on vulnerable versions of tsconfig-paths
node_modules/eslint-import-resolver-typescript
eslint-plugin-import >=2.24.2
Depends on vulnerable versions of tsconfig-paths
node_modules/eslint-plugin-import
@nuxtjs/eslint-config >=7.0.0
Depends on vulnerable versions of eslint-plugin-import
node_modules/@nuxtjs/eslint-config
@nuxtjs/eslint-config-typescript >=7.0.0
Depends on vulnerable versions of @nuxtjs/eslint-config
node_modules/@nuxtjs/eslint-config-typescript
A new severe vulnerability has been found in json5 < 2.2.2
The version os tsconfig-paths that this plugin uses needs updating. 4.1.1 is the latest release which will update json5 to the latest version too. But this package requires 3.14.1
Is there any change of an update ASAP please?
This package is being used by a NuxtJS eslint config plugin I am using and should there be breaking changes or a major semver release as a result I will raise an issue there to get that updated too.
I'll raise an issue there so the maintainers can track this vulnerability.
This is my npm audit report: