fix(deps): update dependency micromatch to v4.0.8 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
micromatch	4.0.7 -> 4.0.8

GitHub Vulnerability Alerts

CVE-2024-4067

The NPM package micromatch prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persisted prior to https://github.com/micromatch/micromatch/pull/266. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.

---

Release Notes

micromatch/micromatch (micromatch)

v4.0.8

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for jestjs ready!

Name	Link
🔨 Latest commit	fa72946
🔍 Latest deploy log	https://app.netlify.com/sites/jestjs/deploys/66e24aaa6f9efe0008823b44
😎 Deploy Preview	https://deploy-preview-15301--jestjs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[gustawdaniel-statscore]

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Uncontrolled resource consumption in braces            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ braces                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <3.0.3                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                     │
│                     │ [email protected] > [email protected] >  │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] > [email protected] >  │
│                     │ [email protected] > [email protected] >  │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                          │
│                     │ [email protected] >                         │
│                     │ @jest/[email protected] >                       │
│                     │ [email protected] > [email protected] >     │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ ... Found 755 paths, run `pnpm why braces` for more    │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-grv7-fg5c-xmjg      │
└─────────────────────┴────────────────────────────────────────────────────────┘
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ Regular Expression Denial of Service (ReDoS) in        │
│                     │ micromatch                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ micromatch                                             │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <4.0.8                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=4.0.8                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                     │
│                     │ [email protected] > [email protected]    │
│                     │                                                        │
│                     │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] > [email protected] >  │
│                     │ [email protected] > [email protected]    │
│                     │                                                        │
│                     │ . > @jest/[email protected] >                     │
│                     │ @jest/[email protected] >                          │
│                     │ [email protected] >                         │
│                     │ @jest/[email protected] >                       │
│                     │ [email protected] > [email protected]       │
│                     │                                                        │
│                     │ ... Found 754 paths, run `pnpm why micromatch` for     │
│                     │ more information                                       │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-952p-6rrq-rcjv      │
└─────────────────────┴────────────────────────────────────────────────────────┘

[medet-mattr]

When will this be merged?

[SimenB]

#15322

However, you don't need Jest to update for this - you can update your own lockfile

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.