Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg #248

Open
fabianszabo opened this issue Jul 1, 2024 · 0 comments

Comments

@fabianszabo
Copy link

I guess this is an issue with tailwindcss rather than this package? But I still wanted to mention it.

# npm audit report

braces  <3.0.3
Severity: high
Uncontrolled resource consumption in braces - https://github.com/advisories/GHSA-grv7-fg5c-xmjg

npm ls braces prints this:

└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ [email protected]
    │ └── [email protected]
    └─┬ [email protected]
      └── [email protected] deduped

npm explain braces prints this:

[email protected] dev peer
node_modules/braces
  braces@"~3.0.2" from [email protected]
  node_modules/chokidar
    chokidar@"^3.5.3" from [email protected]
    node_modules/tailwindcss
      peer tailwindcss@"^3.0.1" from [email protected]
      node_modules/tailwindcss-elevation
        dev tailwindcss-elevation@"^2.0.0" from the root project
  braces@"^3.0.2" from [email protected]
  node_modules/micromatch
    micromatch@"^4.0.4" from [email protected]
    node_modules/fast-glob
      fast-glob@"^3.3.0" from [email protected]
      node_modules/tailwindcss
        peer tailwindcss@"^3.0.1" from [email protected]
        node_modules/tailwindcss-elevation
          dev tailwindcss-elevation@"^2.0.0" from the root project
    micromatch@"^4.0.5" from [email protected]
    node_modules/tailwindcss
      peer tailwindcss@"^3.0.1" from [email protected]
      node_modules/tailwindcss-elevation
        dev tailwindcss-elevation@"^2.0.0" from the root project
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant