lukeed/clsxPublic

A tiny (239B) utility for constructing `className` strings conditionally.

fix(deps): update terser to 4.8.1 to resolve ReDoS vulnerability #115

Closedtheluckystrikeclosed 1 commit intomasterfromrefs/pull/115/head
  1. TH
    theluckystrike

    ## What Updates terser from 4.8.0 to 4.8.1 to resolve a high severity ReDoS (Regular Expression Denial of Service) vulnerability.

    ## Why The vulnerability (GHSA-4wf5-vphf-c2xc) allows attackers to cause a denial of service by providing a specially crafted regular expression. This is a security fix that should be applied as soon as possible.

    ## How `npm audit fix --force` was used to update terser to the patched version 4.8.1.

    ## Testing - [x] Build passes (`npm run build`) - [x] npm audit shows 0 vulnerabilities after fix

    ## Notes - Tests have a pre-existing issue with ESM imports that is unrelated to this change - The terser version update is outside the stated dependency range but necessary for security

    ---

    *Contributed by [theluckystrike](https://github.com/theluckystrike) | [Zovo](https://zovo.one) — Chrome Extension Studio*

  2. ZBfix(deps): update terser to 4.8.1 to resolve ReDoS vulnerability36b41f2
  3. TH
    theluckystrike
    Author

    This updates terser from 4.6.7 to 4.8.1 to resolve a Regular Expression Denial of Service vulnerability in the build toolchain. The fix is a patch-level devDependency update with no impact on the published package.

  4. TH
    theluckystrike
    Author

    Closing - repo has not had a commit in 18+ months (last: June 2024), blacklisted per Zovo PR policy.

  5. theluckystrikeclosed8 months ago on GitHub