vercel/serve-handler

Vulnerability in minimatch 3.0.4

kachkaev opened this issue 2 years ago · 2 comments

kachkaev commented 2 years ago

Details: https://nvd.nist.gov/vuln/detail/CVE-2022-3517

The version of minimatch is pinned in package.json:

serve-handler/package.json

Line 70 in c7a4043

"minimatch": "3.0.4",

Number of weekly package downloads: 2.5M

Could you please merge #180 and release a new version? 🙏

kachkaev commented 2 years ago

@TooTallNate @leo 🙏

imki123 commented 2 years ago

Please update minimatch@^3.0.5 🙏