Vulnerability Identified in the dependency glob npm package

[kkpranesh]

Missing Release of Resource after Effective Lifetime
Vulnerable module
inflight
Introduced through
[email protected] > [email protected] > [email protected]
Fixed in
[email protected]

Fix: Update the glob npm package

[comeonyo]

Hello, I’ve encountered a similar problem related to the outdated version of glob used in sequelize-typescript.

Here are the details:

When running npm install, I receive multiple warnings about deprecated versions of glob:

npm WARN deprecated [email protected]: Glob versions prior to v9 are no longer supported
npm WARN deprecated [email protected]: Glob versions prior to v9 are no longer supported

After investigating, I found that [email protected] depends on [email protected]:

$ npm ls glob
├─┬ [email protected]
│ └── [email protected]

The issue with outdated glob is critical as versions prior to v9 are no longer supported and may cause compatibility or security concerns. Additionally, warnings like these can clutter the installation process and make debugging more difficult for teams.

Would it be possible to update the dependency on glob to a more recent version (v9 or higher)? This would help prevent deprecation warnings and ensure better support for downstream projects.