Issue description

typeorm is using glob version that contains CVE

Expected Behavior

Actual Behavior

Scan tools find high CVE in the latest typeorm version

Steps to reproduce

Use the latest package version build your code and scan it using JFrog or any other scan tools. You will find the vulnerable glob version in the package-lock file:
typeorm@0.3.27(ioredis@5.6.1)(pg@8.16.3)(reflect-metadata@0.2.2)(ts-node@10.9.2(@types/node@22.16.5)(typescript@5.8.3)):
dependencies:
'@sqltools/formatter': 1.2.5
ansis: 3.17.0
app-root-path: 3.1.0
buffer: 6.0.3
dayjs: 1.11.13
debug: 4.4.1
dedent: 1.6.0
dotenv: 16.6.1
glob: 10.4.5
reflect-metadata: 0.2.2
sha.js: 2.4.12
sql-highlight: 6.1.0
tslib: 2.8.1
uuid: 11.1.0
yargs: 17.7.2
optionalDependencies:
ioredis: 5.6.1
pg: 8.16.3
ts-node: 10.9.2(@types/node@22.16.5)(typescript@5.8.3)
transitivePeerDependencies:
- babel-plugin-macros
- supports-color

My Environment

typeorm@0.3.27(ioredis@5.6.1)(pg@8.16.3)(reflect-metadata@0.2.2)(ts-node@10.9.2(@types/node@22.16.5)(typescript@5.8.3)):
dependencies:
'@sqltools/formatter': 1.2.5
ansis: 3.17.0
app-root-path: 3.1.0
buffer: 6.0.3
dayjs: 1.11.13
debug: 4.4.1
dedent: 1.6.0
dotenv: 16.6.1
glob: 10.4.5
reflect-metadata: 0.2.2
sha.js: 2.4.12
sql-highlight: 6.1.0
tslib: 2.8.1
uuid: 11.1.0
yargs: 17.7.2
optionalDependencies:
ioredis: 5.6.1
pg: 8.16.3
ts-node: 10.9.2(@types/node@22.16.5)(typescript@5.8.3)
transitivePeerDependencies:
- babel-plugin-macros
- supports-color

Additional Context

No response

Relevant Database Driver(s)

• aurora-mysql
• aurora-postgres
• better-sqlite3
• cockroachdb
• cordova
• expo
• mongodb
• mysql
• nativescript
• oracle
• postgres
• react-native
• sap
• spanner
• sqlite
• sqlite-abstract
• sqljs
• sqlserver

Are you willing to resolve this issue by submitting a Pull Request?

No, I don’t have the time and I’m okay to wait for the community / maintainers to resolve this issue.