Vulnerability coming from micromatch > braces

[XhmikosR]

 Low             Regular Expression Denial of Service

 Package         braces

 Patched in      >=2.3.1

 Dependency of   rollup-plugin-babel [dev]

 Path            rollup-plugin-babel > rollup-pluginutils > micromatch >
                 braces

 More info       https://nodesecurity.io/advisories/786

...which is weird since I see you already target micromatch ^2.3.1. I've tried cleaning up local node_modules and package-lock.json and doing npm i, same thing.

Maybe the advisory has the wrong info?

[XhmikosR]

Ah, yeah, I need more coffee. 2.3.1 is the braces version not the micromatch version.

So, it seems this needs micromatch >= 3.1.6 which could break some things, although judging from their changelog it should work https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md#300---2017-04-11

[XhmikosR]

The comment is there, don't be rude.

[XhmikosR]

You are still being rude.

[lukastaegert]

A RegExp DoS issue is breaking the Rollup eco system? In what universe would this be an issue for Rollup users? But I agree this needs to be fixed, Rollup's own builds are breaking as well.

Unfortunately there are good reasons we did no upgrade micromatch yet, in short #43. Will have another look if something can be done about the size issue, otherwise upgrade needs to be the way to go for now.

I just hope they finally get the 4.0 version going: micromatch/micromatch#137

[XhmikosR]

The problem is it breaks CI for many people. I've made a PR but since I can't test it thoroughly I'm gonna close it for now.

[lukastaegert]

I know, as it is breaking for us. I am on it, expect a resolution in the next hours.

[lukastaegert]

Should be resolved now but I was wrong about the size increase—the next version of Rollup WILL be 50% larger because micromatch@3 thinks it needs to have every stupid dependency out there. Seriously starting to look at minimatch again.

[XhmikosR]

Are you sure tslint needs to be in the dependencies ?

…

On Sat, Feb 16, 2019, 19:56 Lukas Taegert-Atkinson ***@***.*** wrote: Should be resolved now but I was wrong about the size increase—the next version of Rollup WILL be 50% larger because ***@***.*** thinks it needs to have every stupid dependency out there. Seriously starting to look at minimatch again. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#51 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAVVtaHgzBF3kTcq_7F4r-UQwyUy6XVcks5vOEYxgaJpZM4a-3SP> .

[lukastaegert]

Definitely not, fixed

[phiphan148]

I got the same problem, how to fix it?