CVE-2021-23425

[erikzenkerLogmein]

Hey,

I want to report that you have a vulnerability in one of your depencencies:

Title: Uncontrolled Resource Consumption in trim-off-newlines
Severity: moderate
Module: trim-off-newlines
Url: https://github.com/advisories/GHSA-38fc-wpqx-33j7
Vulnerable Version: <=1.0.1
Patched Version: <0.0.0
Path: semantic-release>@semantic-release/release-notes-generator>conventional-commits-parser>trim-off-newlines

As far as I can see the issue is already addressed in the conventional-changelog monorepo: conventional-changelog/conventional-changelog#840 so updating the dependency would solve the problem.

Also reported here: semantic-release/release-notes-generator#300

[gr2m]

we don't lock the dependency version. You can delete your dependencies and lock file, then reinstall, to get the latest version of conventional-changelog within the breaking version range

[erikzenkerLogmein]

Thank you @gr2m that did the trick!