[Security] Bump micromatch from 4.0.7 to 4.0.8
Bumps micromatch from 4.0.7 to 4.0.8. This update includes a security fix.
Vulnerabilities fixed
Regular Expression Denial of Service (ReDoS) in micromatch The NPM package
micromatch
is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs inmicromatch.braces()
inindex.js
because the pattern.*
will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.Patched versions: none Affected versions: <= 4.0.7
Changelog
Sourced from micromatch's changelog.
[4.0.8] - 2024-08-22
- backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch
Commits
-
8bd704e
4.0.8 -
a0e6841
run verb to generate README documentation -
4ec2884
Merge branch 'v4' into hauserkristof-feature/v4.0.8 -
03aa805
Merge pull request #266 from hauserkristof/feature/v4.0.8 -
814f5f7
lint -
67fcce6
fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5 -
113f2e3
fix: CVE numbers in CHANGELOG -
d9dbd9a
feat: updated CHANGELOG -
2ab1315
fix: use actions/setup-node@v4 -
1406ea3
feat: rework test to work on macos with node 10,12 and 14 - Additional commits viewable in compare view
Dependabot commands
You can trigger Dependabot actions by commenting on this MR
-
$dependabot recreate
will recreate this MR rewriting all the manual changes and resolving conflicts