update micromatch to address CVE-2024-4068

[indera]

closes #443

What is the purpose of this pull request?

Fix a security vulnerability for braces

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4068

What changes did you make? (Give an overview)

Updated one line in packages.json to point to the fixed versions

micromatch/micromatch#249
micromatch/braces#35

--> https://github.com/micromatch/braces/releases/tag/3.0.3

[indera]

@mrmlnc Please take a look when you get a moment - this is a vulnerability fix.

@XhmikosR Can you you take a look please?

Thank you!

[alex-stout]

@mrmlnc / @XhmikosR - could this be prioritized as it's a CVE patch?

[XhmikosR]

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

[saumeya]

Hi, can this change be merged and new version be released. I need to address this CVE in our project as well.

[LMatass]

+1

With this PR 2 high vulnerabilities will be fixed

[saumeya]

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

Why is it unneeded?

[sharknoon]

I'm not the maintainer of the package but this change is pretty much unneeded since the current version range already allows for this update...

Thank you for your reply. Unfortunately this version range allowes the unpatched version to be used. This PR enforces the use of the patched version.

[gustawdaniel-statscore]

It should help to solve

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ high                │ Uncontrolled resource consumption in braces            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ braces                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <3.0.3                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=3.0.3                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @typescript-eslint/[email protected] >          │
│                     │ @typescript-eslint/[email protected] >                     │
│                     │ @typescript-eslint/[email protected] >          │
│                     │ [email protected] > [email protected] > [email protected] >   │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ . > @typescript-eslint/[email protected] >          │
│                     │ @typescript-eslint/[email protected] >                 │
│                     │ @typescript-eslint/[email protected] >          │
│                     │ [email protected] > [email protected] > [email protected] >   │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ . > @typescript-eslint/[email protected] >          │
│                     │ @typescript-eslint/[email protected] >                 │
│                     │ @typescript-eslint/[email protected] >                      │
│                     │ @typescript-eslint/[email protected] >          │
│                     │ [email protected] > [email protected] > [email protected] >   │
│                     │ [email protected]                                           │
│                     │                                                        │
│                     │ ... Found 13423 paths, run `pnpm why braces` for more  │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-grv7-fg5c-xmjg      │
└─────────────────────┴────────────────────────────────────────────────────────┘

[mrmlnc]

Thanks for the pull request.

I don't consider this CVE to be a real threat to anything. I think this comment reflects my personal feelings on the matter.

The current pull request updates the dependency in the current branch, which is targeted for the upcoming version (4.x.x).

I will try to port the changes to the branch of the current version of the package. And if it succeeds without major breakdowns, I will release a new version (3.x.x). This week.

[ZheSun88]

Hi @mrmlnc , will we get a 3.x.x with this fix soon?