chore(deps): update dependency stylelint to v15 [security] - autoclosed #549

renovate · 2023-07-08T01:22:54Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
stylelint (source)	`14.16.1` -> `15.10.1`

GitHub Vulnerability Alerts

GHSA-f7xj-rg7h-mc87

Summary

Our meow dependency (which we use for our CLI) depended on [email protected] . A vulnerability in this version of semver was recently identified and surfaced by npm audit:

Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw

Details

Original post by the reporter:

"my npm audit show the report

semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available

And my dependencies tree for semver show your package

├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped

I found that [email protected] contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7. But I can't update meow to the new major version because your package doesn't allow it."

Update your package to use the 'meow' version >=10"

PoC

N/A

Impact

We anticipate the impact to be low as Stylelint is a dev tool and meow is only used on the CLI pathway.

⬇️ EDITED AFTER PUBLISHED ⬇️

Security fix backported to older `semver` versions

The same security fix has been backported to older semver versions of 5.x and 6.x. See the CVE-2022-25883 details.

So, you can fix this vulnerability by just updating semver in your project's dependency tree, instead of updating stylelint. For details, see the example:

package.json:

{
  "dependencies": {
    "stylelint": "15.10.0"
  }
}

Run npm audit (here is no alert for semver):

$ npm ci
...

$ npm audit
...
stylelint  8.0.0 - 15.10.0
Stylelint has vulnerability in semver dependency - https://github.com/advisories/GHSA-f7xj-rg7h-mc87
fix available via `npm audit fix --force`
Will install [email protected], which is outside the stated dependency range
node_modules/stylelint

1 low severity vulnerability
...

$ npm ls semver
...
└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └── [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └── [email protected]

Release Notes

stylelint/stylelint (stylelint)

chore(deps): update dependency stylelint to v15 [security] - autoclosed #549

chore(deps): update dependency stylelint to v15 [security] - autoclosed #549

Conversation

renovate bot commented Jul 8, 2023 • edited Loading

GitHub Vulnerability Alerts

Summary

Details

PoC

Impact

Security fix backported to older semver versions

Release Notes

Configuration

socket-security bot commented Jul 8, 2023 • edited Loading

renovate bot commented Jul 8, 2023 •

edited

Loading

Security fix backported to older `semver` versions

socket-security bot commented Jul 8, 2023 •

edited

Loading