Dependabot "No security update is needed as ansi-regex is no longer vulnerable"

user_994439 0
Viewed 2134

Dependabot first reported and then retracted a security problem in a package. The basis of the retraction isn't given, just that the package "is no longer vulnerable." That makes no sense. The original CVE is still out there and the affected code is still referenced.

enter image description here

On investigation I find that the given package is in yarn.lock twice, once in a version that contains the vulnerability and later in a version that contains the patch:

    ansi-regex@^2.0.0:
      version "2.1.1"    
    ansi-regex@^5.0.0:
      version "5.0.0"````

I'd be grateful for any way to make sense of this.
dependabot dependencies security
2 Answers

If this source is accurate, it's because the two ansi-regex versions you've listed do not contain the vulnerability:

Confirmed 4.1.0 and 3.0.0 as affected testing using the provided reproducer. 2.1.1 does not reproduce the issue.

3.0.0 is the first affected, as that's the first version that includes 69bebf6 that the problematic part of the regex.

user_11011090

Thanks to answerers for your expertise.

I think the most likely diagnosis is a Dependabot bug. Generally it is wishful thinking to blame your tools but in this case it is the simplest answer by far.

user_9944390
Related