Security advice semver

[NormandoHall]

GHSA-c2qf-rxjj-qqgw

nodemon  1.4.10-alpha.1 - 1.4.10-alpha.3 || >=1.14.10
  Depends on vulnerable versions of semver
  Depends on vulnerable versions of simple-update-notifier

[wellwelwel]

A lot of packages use semver in versions earlier than 7.5.2.

---

I solved it temporally by:

YARN

package.json

"resolutions": {
  "**/semver": "^7.5.2"
}

• Then

yarn install

• Checking

yarn audit

---

NPM

package.json

"resolutions": {
  "semver": "7.5.2"
}

• Then

npm i -D npm-force-resolutions
npx npm-force-resolutions

• Checking

npm audit

[fluentmoheshwar]

A lot of packages use semver in versions earlier than 7.5.2.

I solved it temporally by:

YARN

package.json

"resolutions": {
  "**/semver": "^7.5.2"
}

• Then

yarn install

• Checking

yarn audit

NPM

package.json

"resolutions": {
  "semver": "7.5.2"
}

• Then

npm i -D npm-force-resolutions
npx npm-force-resolutions

• Checking

npm audit

you could also use (doesn't require npm-force-resolutions):

"overrides": {
        "semver": "7.5.2"
 }

[joaomoreno]

A better approach:

	"overrides": {
		"nodemon": {
			"simple-update-notifier": {
				"semver": "^7.5.2"
			}
		}
	}

[zang3tsu88]

A better approach:

	"overrides": {
		"nodemon": {
			"simple-update-notifier": {
				"semver": "^7.5.2"
			}
		}
	}

Thanks, but this one doesnt fix the issue. Out of 3 moderate vulnerabilities it leaves 2.
The previous one helped.

[github-actions]

🎉 This issue has been resolved in version 3.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀