Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump tsconfig-paths dependency version to fix CVE-2022-46175 #2634

Closed
nbouvrette opened this issue Dec 31, 2022 · 1 comment
Closed

Bump tsconfig-paths dependency version to fix CVE-2022-46175 #2634

nbouvrette opened this issue Dec 31, 2022 · 1 comment

Comments

@nbouvrette
Copy link

eslint-plugin-import depends on tsconfig-paths that depends on json5 2.2.1 which is susceptible to CVE-2022-46175.

Once that tsconfig-paths releases a fix (see discussion here), eslint-plugin-import should update its tsconfig-paths dependency to this new version to correct the vulnerability.

@ljharb
Copy link
Member

ljharb commented Jan 1, 2023

json5 v1.0.2 has already been updated with this fix, and either way, it's not a valid vulnerability.

As is the case with almost every JS CVE, the best course of action is to do nothing until the ecosystem fixes it for you.

This is a duplicate of #2625; a duplicate of #2628; a duplicate of #2626; a duplicate of #2627; a duplicate of #2631; a duplicate of #2632.

Please stop filing issues about a vulnerability on "not the vulnerable package", it doesn't help.

@ljharb ljharb closed this as not planned Won't fix, can't repro, duplicate, stale Jan 1, 2023
@import-js import-js deleted a comment from air2 Jan 2, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants