npm audit reports a high-severity vulnerability in the transitive dependency brace-expansion.
Dependency chain:
eslint-plugin-react@7.37.5
└── minimatch@3.1.5
└── brace-expansion@1.1.16
Advisory:
GHSA-mh99-v99m-4gvg
Impact:
This is a development dependency used by ESLint. There is currently no non-breaking upgrade available because the latest eslint-plugin-react still depends on minimatch 3.x.
Recommendation:
- Monitor upstream packages for updates.
- Upgrade once eslint-plugin-react or minimatch releases a version with the patched dependency.
- No action required for production if
npm audit --omit=dev --audit-level=high reports no high vulnerabilities.
npm audit reports a high-severity vulnerability in the transitive dependency
brace-expansion.Dependency chain:
eslint-plugin-react@7.37.5
└── minimatch@3.1.5
└── brace-expansion@1.1.16
Advisory:
GHSA-mh99-v99m-4gvg
Impact:
This is a development dependency used by ESLint. There is currently no non-breaking upgrade available because the latest eslint-plugin-react still depends on minimatch 3.x.
Recommendation:
npm audit --omit=dev --audit-level=highreports no high vulnerabilities.