[CVE-2024-4067] Vulnerability detected in micromatch.braces() about micromatch HOT 8 OPEN

It looks like this regressed between 4.0.6 — which removed the pattern as part of a4a4dbe — and 4.0.7 (which does not contain this commit).

Overall the release of 4.0.7 looks a little strange; the package.json file on master still states 4.0.6.

Edit: Looks like 4.0.7 was released based on the v4 branch, which looks to have diverged from master. I have created #260

from micromatch.

Hello,

I have the latest version of micromatch 4.0.7 and braces 3.0.3. I updated through override of the dependencies. But the vulnerability still appears on the security report.

Any more tips that I can try?

from micromatch.

package-lock.json, yarn.lock or pnpm-lock.yaml.

from micromatch.

Thank you @jacobjmarks. Could kindly update this thread when the issue is fixed?

from micromatch.

Hm, there's this 5-year old pinned issue at the top of the issues page.

Does it still apply today?

from micromatch.

Micromatch doesn't have a pined dependency on braces. if you remove your lock file, you'll get the latest version of braces with the fix

from micromatch.

@JeanMeche Which lock file are you talking about?

from micromatch.

If you're using pnpm you can use pnpm up braces for a more fine-grained update than deleting the whole lock file.

from micromatch.