glob-parent: Regular expression denial of service

Question

I got my build broken because yarn audit says there is a vulnerability in my dependencies:

yarn audit
yarn audit v1.22.5
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=5.1.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server > chokidar > glob-parent                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1751                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 819
Severity: 1 Moderate
Done in 0.67s.

Exited with code exit status 4

user_4487123 · Answer

May be the best solution will be upgrade webpack-dev-server to version 4. Chokidar was updated there. Also, as mentioned here, version 4 is RC now, stable release will be in very near future. https://github.com/webpack/webpack-dev-server/issues/3407#issuecomment-884525530

user_12544391 · Answer

in your package.json add:

  "resolutions": {
    "glob-parent": "5.1.2"
  }

and you can ignore the warning:

warning Resolution field "glob-parent@5.1.2" is incompatible with requested version "glob-parent@^3.1.0"

glob-parent: Regular expression denial of service

2 Answers