-
-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Bump tsconfig-paths
dependency version to fix CVE-2022-46175
#2634
Comments
json5 v1.0.2 has already been updated with this fix, and either way, it's not a valid vulnerability. As is the case with almost every JS CVE, the best course of action is to do nothing until the ecosystem fixes it for you. This is a duplicate of #2625; a duplicate of #2628; a duplicate of #2626; a duplicate of #2627; a duplicate of #2631; a duplicate of #2632. Please stop filing issues about a vulnerability on "not the vulnerable package", it doesn't help. |
eslint-plugin-import depends on tsconfig-paths that depends on json5 2.2.1 which is susceptible to CVE-2022-46175.
Once that tsconfig-paths releases a fix (see discussion here), eslint-plugin-import should update its
tsconfig-paths
dependency to this new version to correct the vulnerability.The text was updated successfully, but these errors were encountered: