From b379b739aa25fcaab462e2479e68fcba1c4f9895 Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Wed, 1 Apr 2026 16:55:10 +0000 Subject: [PATCH] =?UTF-8?q?fix(deps):=20bump=20path-to-regexp=208.3.0=20?= =?UTF-8?q?=E2=86=92=208.4.1=20to=20patch=20ReDoS=20CVEs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Transitive dep via express → router. Fixes: - GHSA-27v5-c462-wpq7 (ReDoS via multiple wildcards) - GHSA-j3q9-mxjg-w52f (DoS via sequential optional groups) router@2.2.0 accepts ^8.0.0, so this is a clean lockfile-only bump. --- package-lock.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package-lock.json b/package-lock.json index cec8c63a..8487ac45 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7282,9 +7282,9 @@ } }, "node_modules/path-to-regexp": { - "version": "8.3.0", - "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz", - "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==", + "version": "8.4.1", + "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.1.tgz", + "integrity": "sha512-fvU78fIjZ+SBM9YwCknCvKOUKkLVqtWDVctl0s7xIqfmfb38t2TT4ZU2gHm+Z8xGwgW+QWEU3oQSAzIbo89Ggw==", "license": "MIT", "funding": { "type": "opencollective",