Cypress-cucumber-preprocessor: Update @cypress/browserify-preprocessor dependency to ^2.0.0?

[scantisani]

Cypress-cucumber-processor depends on version 1.1.2 of @cypress/browserify-preprocessor, which has a transitive dependency on an old version of braces (1.8.5). Versions of braces below 2.3.1 have a REDOS vulnerability.

Upgrading to @cypress/browserify-processor to 2.0 or later would fix the issue, but release 2.0 does remove cjsx support. If that isn't a problem, would it be possible to bump the version for the next release?

Thanks for your hard work on the library!

[jimmyandrade]

@danielcn and I are experiencing the same problem. Here's our dependency tree (highlighting braces):

├─┬ [email protected]
│ ├─┬ @cypress/[email protected]
│ │ └─┬ [email protected]
│ │   └─┬ [email protected]
│ │     └─┬ [email protected]
│ │       └── [email protected]
│ └─┬ [email protected]
│   └── [email protected] 
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]  deduped

When we run npm audit we find this:

                       === npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cypress-cucumber-preprocessor [dev]                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cypress-cucumber-preprocessor >                              │
│               │ @cypress/browserify-preprocessor > watchify > anymatch >     │
│               │ micromatch > braces                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.3.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ cypress-cucumber-preprocessor [dev]                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ cypress-cucumber-preprocessor >                              │
│               │ @cypress/browserify-preprocessor > watchify > chokidar >     │
│               │ anymatch > micromatch > braces                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 2 low severity vulnerabilities in 890986 scanned packages
  2 vulnerabilities require manual review. See the full report for details.

The last version of @cypress/browserify-preprocessor is 2.1.1.

Please update @cypress/browserify-preprocessor dependency to ^2.1.1 🙏

[lgandecki]

:tada: This issue has been resolved in version 1.16.0 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: