Should upgrade the meow to latest version to fix the security issue CVE-2022-25883?

Open
#84 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
javascript
Domain
security

Research direction

Start by inspecting the MapBox polyline dependency metadata and the meow dependency chain through normalize-package-data and semver. Confirm how the current semver@5.7.2 is selected and identify the dependency update needed to reach a non-vulnerable semver version. Done means the dependency chain no longer resolves to the vulnerable version and the project's existing checks pass.

Written by the indexing model from the issue text.

Description

Looks MapBox polyline depends on meow which has dependency on normalize-package-data and semver.

But the latest MapBox polyline is referencing the semver@5.7.2 which has CVE-2022-25883 security issue.

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Could you please help to upgrade the meow to latest? Thanks.

Dominant language
JavaScript
Stars
674
Forks
101
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from mapbox/polyline

All issues in mapbox/polyline

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.