semver vulnerable to Regular Expression Denial of Service

[prince76007]

Issue Summary

semver <5.7.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - CVE-2022-25883 - GitHub Advisory Database
No fix available
node_modules/utf7/node_modules/semver
utf7 >=1.0.2
Depends on vulnerable versions of semver
node_modules/utf7
node-imap *
Depends on vulnerable versions of utf7
node_modules/node-imap

• twilio-node version: ^4.16.0
• node version: 18

[sbansla]

Below shows the semver versions we are using
├─┬ @babel/[email protected]
│ ├─┬ @babel/[email protected]
│ │ └── [email protected] deduped
│ ├─┬ @babel/[email protected]
│ │ └── [email protected] deduped
│ ├─┬ [email protected]
│ │ ├─┬ @babel/[email protected]
│ │ │ └── [email protected] deduped
│ │ └── [email protected] deduped
│ └── [email protected]
├─┬ [email protected]
│ └─┬ @jest/[email protected]
│ ├─┬ @jest/[email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected] deduped
│ │ └─┬ [email protected]
│ │ └─┬ [email protected]
│ │ └── [email protected] deduped
│ └─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └── [email protected]
└─┬ [email protected]
└── [email protected]

[sbansla]

@prince76007 Thank you for informing us. We have upgraded the semver version. It was a transitive dependency for us.
Below is the PR. Closing this ticket, You can reopen it if you have questions.
#966