Skip to content

update micromatch to address CVE-2024-4068#444

Merged
mrmlnc merged 1 commit intomrmlnc:masterfrom
indera:update-micromatch
Jun 23, 2024
Merged

update micromatch to address CVE-2024-4068#444
mrmlnc merged 1 commit intomrmlnc:masterfrom
indera:update-micromatch

Conversation

@indera
Copy link
Contributor

@indera indera commented May 30, 2024 •
edited
Loading

closes #443

What is the purpose of this pull request?

Fix a security vulnerability for braces

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4068

What changes did you make? (Give an overview)

Updated one line in packages.json to point to the fixed versions

micromatch/micromatch#249
micromatch/braces#35

--> https://github.com/micromatch/braces/releases/tag/3.0.3

@indera
Copy link
Contributor Author

indera commented May 30, 2024 •
edited
Loading

@mrmlnc Please take a look when you get a moment - this is a vulnerability fix.

@XhmikosR Can you you take a look please?

Thank you!

@indera indera changed the title update micromatch to address vuln update micromatch to address CVE-2024-4068 May 31, 2024
@indera indera mentioned this pull request Jun 1, 2024
Closed
@alex-stout
Copy link

alex-stout commented Jun 6, 2024

@mrmlnc / @XhmikosR - could this be prioritized as it's a CVE patch?

@XhmikosR
Copy link
Contributor

XhmikosR commented Jun 8, 2024

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

@saumeya
Copy link

saumeya commented Jun 10, 2024

Hi, can this change be merged and new version be released. I need to address this CVE in our project as well.

@LMatass
Copy link

LMatass commented Jun 13, 2024

+1

With this PR 2 high vulnerabilities will be fixed

@saumeya
Copy link

saumeya commented Jun 13, 2024

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

Why is it unneeded?

@sharknoon
Copy link

sharknoon commented Jun 14, 2024

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

Thank you for your reply. Unfortunately this version range allowes the unpatched version to be used. This PR enforces the use of the patched version.

@gustawdaniel-statscore
Copy link

gustawdaniel-statscore commented Jun 17, 2024

It should help to solve

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Uncontrolled resource consumption in braces            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ braces                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <3.0.3                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @typescript-eslint/eslint-plugin@7.13.0 >          │
│                     │ @typescript-eslint/parser@7.13.0 >                     │
│                     │ @typescript-eslint/typescript-estree@7.13.0 >          │
│                     │ globby@11.1.0 > fast-glob@3.3.2 > micromatch@4.0.5 >   │
│                     │ braces@3.0.2                                           │
│                     │                                                        │
│                     │ . > @typescript-eslint/eslint-plugin@7.13.0 >          │
│                     │ @typescript-eslint/type-utils@7.13.0 >                 │
│                     │ @typescript-eslint/typescript-estree@7.13.0 >          │
│                     │ globby@11.1.0 > fast-glob@3.3.2 > micromatch@4.0.5 >   │
│                     │ braces@3.0.2                                           │
│                     │                                                        │
│                     │ . > @typescript-eslint/eslint-plugin@7.13.0 >          │
│                     │ @typescript-eslint/type-utils@7.13.0 >                 │
│                     │ @typescript-eslint/utils@7.13.0 >                      │
│                     │ @typescript-eslint/typescript-estree@7.13.0 >          │
│                     │ globby@11.1.0 > fast-glob@3.3.2 > micromatch@4.0.5 >   │
│                     │ braces@3.0.2                                           │
│                     │                                                        │
│                     │ ... Found 13423 paths, run `pnpm why braces` for more  │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-grv7-fg5c-xmjg      │
└─────────────────────┴────────────────────────────────────────────────────────┘

@mrmlnc mrmlnc merged commit f3a7f21 into mrmlnc:master Jun 23, 2024
@mrmlnc
Copy link
Owner

mrmlnc commented Jun 23, 2024 •
edited
Loading

Thanks for the pull request.

I don't consider this CVE to be a real threat to anything. I think this comment reflects my personal feelings on the matter.

The current pull request updates the dependency in the current branch, which is targeted for the upcoming version (4.x.x).

I will try to port the changes to the branch of the current version of the package. And if it succeeds without major breakdowns, I will release a new version (3.x.x). This week.

@harlan-zw harlan-zw mentioned this pull request Jun 28, 2024
Merged
@indera indera deleted the update-micromatch branch August 16, 2024 21:06
@ZheSun88
Copy link

ZheSun88 commented Aug 23, 2024

Hi @mrmlnc , will we get a 3.x.x with this fix soon?

@mrmlnc mrmlnc added this to the 3.3.3 milestone Jan 4, 2025
DennisRasey pushed a commit to DennisRasey/forgejo that referenced this pull request Jan 6, 2025
Update dependency fast-glob to v3.3.3 (forgejo) (#6476)
07d7c54 
This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [fast-glob](https://github.com/mrmlnc/fast-glob) | dependencies | patch | [`3.3.2` -> `3.3.3`](https://renovatebot.com/diffs/npm/fast-glob/3.3.2/3.3.3) |

---

### Release Notes

<details>
<summary>mrmlnc/fast-glob (fast-glob)</summary>

### [`v3.3.3`](https://github.com/mrmlnc/fast-glob/releases/tag/3.3.3)

[Compare Source](mrmlnc/fast-glob@3.3.2...3.3.3)

> **Full Changelog**: mrmlnc/fast-glob@3.3.2...3.3.3

#### 💬 Common

-   Refer to micromatch@4.0.8 to avoid annoying npm audit spam ([#&#8203;443](mrmlnc/fast-glob#443), [#&#8203;444](mrmlnc/fast-glob#444), [#&#8203;454](mrmlnc/fast-glob#454), [#&#8203;456](mrmlnc/fast-glob#456), [#&#8203;457](mrmlnc/fast-glob#457), [#&#8203;461](mrmlnc/fast-glob#461))

#### 🐛 Bug fixes

-   Apply absolute negative patterns to full path instead of file path ([#&#8203;441](mrmlnc/fast-glob#441), thanks [@&#8203;webpro](https://github.com/webpro))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "* 0-3 * * *" (UTC), Automerge - "* 0-3 * * *" (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS45MC4wIiwidXBkYXRlZEluVmVyIjoiMzkuOTAuMCIsInRhcmdldEJyYW5jaCI6ImZvcmdlam8iLCJsYWJlbHMiOlsiZGVwZW5kZW5jeS11cGdyYWRlIiwidGVzdC9ub3QtbmVlZGVkIl19-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/6476
Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
Co-authored-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Co-committed-by: Renovate Bot <forgejo-renovate-action@forgejo.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

3.3.3

Development

Successfully merging this pull request may close these issues.

New fast-glob version required due to dependency CVE in micromatch

9 participants

@indera @alex-stout @XhmikosR @saumeya @LMatass @sharknoon @gustawdaniel-statscore @mrmlnc @ZheSun88