@toolpad/core 6 depends on vulnerable versions of path-to-regexp

[nicolo-tito]

Steps to reproduce

npm audit on "@toolpad/core": "^0.6.0"

Current behavior

npm audit report

path-to-regexp 4.0.0 - 6.2.2
Severity: high
path-to-regexp outputs backtracking regular expressions - GHSA-9wv6-86v2-598j
fix available via npm audit fix --force
Will install @toolpad/core@0.5.2, which is a breaking change
node_modules/path-to-regexp
@toolpad/core >=0.6.0
Depends on vulnerable versions of path-to-regexp
node_modules/@toolpad/core

Expected behavior

No response

Context

No response

Your environment

No response

Search keywords: path-to-regexp

[Janpot]

We're working on this in #4074

Edit: path-to-regexp@8.0.0 breaks vitest but the fix is backported to 6.3.0. upgrading it in #4126

[github-actions]

This issue has been closed. If you have a similar problem but not exactly the same, please open a new issue.
Now, if you have additional information related to this issue or things that could help future readers, feel free to leave a comment.

Note

We value your feedback @nicolo-tito! How was your experience with our support team?
We'd love to hear your thoughts in this brief Support Satisfaction survey. Your insights help us improve!