From ccbb6196de3a7160acc2f76a6f5be4aa9a04104f Mon Sep 17 00:00:00 2001 From: Ivo von Putzer Reibegg Date: Fri, 16 Mar 2018 01:01:21 +0100 Subject: [PATCH] fixes known vulnerability CVE-2017-18077 of package brace-expansion Known vulnerability found CVE-2017-18077 Moderate severity index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as de... package-lock.json update suggested: brace-expansion ~> 1.1.7 Always verify the validity and compatibility of suggestions with your codebase. glob@5.0.15 ~> minimatch@3.0.3 ~> brace-expansion@1.1.6 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index eeb01a72..714a683f 100644 --- a/package.json +++ b/package.json @@ -112,7 +112,7 @@ "async": "1.x", "escodegen": "1.8.x", "esprima": "2.7.x", - "glob": "^5.0.15", + "glob": "^7.1.2", "handlebars": "^4.0.1", "js-yaml": "3.x", "mkdirp": "0.5.x",