glob-parent before 6.0.1 vulnerable to Regular Expression Denial of Service (ReDoS)

[josemiguel-alvarez]

glob-parent before 6.0.1 is vulnerable to Regular Expression Denial of Service (ReDoS).

The security issue was fixed here.

Suggested solution

Require version ^6.0.1 of glob-parent using NPM overrides in package.json.

[josemiguel-alvarez]

I've created a PR to fix it: #506

[timlrx]

Hi, as mentioned in the PR, I think there's no need for the patch. It's used internally only by tailwind, contentlayer, eslint and globby. No user is ever going to submit an input for parsing.