Hey there, thanks for the PR , but am I reading that thread correctly in that 4.0.6 is incompatible with the other 4.x releases? It might be better to be technically incorrect on this advisory if so and update it with the fixed and compatible 4.0.8 when that releases (which looks like soon maybe?)

Hey @darakian !

Yeah, it seems to be the case, that the v4.0.6 has been "mislabeled", that should be v5.0.0 and v4.0.7 does not contains the fix.

I also opened a PR micromatch/micromatch#266 for a v4.0.8 that contains the fix for the CVE. I hope it will be merged soon.

Gotcha. Ya, I'd really rather avoid having dependabot tell however many millions of people Hey go update to a version that'll break everything if possible. Would you be ok waiting on 4.0.8 to release and then we can add a patched version to the advisory rather than changing the vulnerable range?

Yeah @darakian , I'll close this PR, and once 4.0.8 has been realesed either with micromatch/micromatch#266 has been merged or other, I'll open a new one with the patched version.

Also, this issue has been around for a while, but I think it is not as severe as it had been set up now...

Yeah @darakian , I'll close this PR, and once 4.0.8 has been realesed either with micromatch/micromatch#266 has been merged or other, I'll open a new one with the patched version.

Sounds good. I'll keep my eyes 👀 peeled for another PR so this can get resolved ASAP.

Also, this issue has been around for a while, but I think it is not as severe as it had been set up now...

Ya, severity is a weird topic. Denial of service in particular is usually a low concern for modern web app stuff where the infra just reboots a server when it locks up/crashes/whatever, but maybe it's a high concern for a car on a highway.

We really need per-project severity adjustments IMO, but failing that moderate is pretty low in the CVE world. If you look at a breakdown of CVSS 3 scores over half are high/crit as per NVD rating
https://nvd.nist.gov/general/nvd-dashboard

Hey @darakian !

The fix has been merged! 🚀

micromatch/micromatch#266

Advisory is updated 👍
GHSA-952p-6rrq-rcjv