Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

build(deps): bump stylus version to "^0.55.0" #19547

Closed
wants to merge 1 commit into from

Conversation

joelop3
Copy link

@joelop3 joelop3 commented Mar 1, 2025

package managers are resolving to stylus@0.51.0, side effecting CVE-2022-3517
stylus@0.51.0 -> glob@3.2.11 -> minimatch@0.3.0

I take deep view of first stylus with glob version fixing the vulnerability due to dependency tree update

package managers are resolving to stylus@0.51.0 which has glob@3.2.x and resolves to glob@3.2.11 which has minimatch@0.3.0 with CVE-2022-3517 vulnerability
@sapphi-red
Copy link
Member

Bumping the version of a peer dependency is a breaking change and we shouldn't do it unless it's a major version bump.

* would allow any version of stylus and wouldn't block package managers from installing newer versions. So this change is not needed.

@sapphi-red sapphi-red closed this Mar 3, 2025
@joelop3
Copy link
Author

joelop3 commented Mar 3, 2025

It not blocks but you need to override in order to be in safe version, against the exploit.

@sapphi-red
Copy link
Member

sapphi-red commented Mar 3, 2025

You don't need overrides. You can run npm audit fix or npm update that-dep.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants