CVE-2024-45296

[curtdept]

Looks like nise is pulling in a vulnerable version of path-to-regexp

GHSA-9wv6-86v2-598j

[dzq-stars]

Any solutions?

[alexpech12]

Latest release of path-to-regexp includes the pathToRegexp function again https://github.com/pillarjs/path-to-regexp/releases/tag/v8.1.0

Tests fail for me though...

[alexpech12]

#226

Still one failing test Tests are green

[fatso83]

Great, thanks for putting in the work, @alexpech12 !

[skazantsev]

@fatso83 would it be possible to backport the fix into v5.x.x so that versions 11.x - 17.x of sinon received this fix without a need to update to 18.x?

[fatso83]

@skazantsev That would be possible, but it's not as easy as it sounds. Refer to this issue: googleapis/nodejs-bigquery-storage#475

Upgrading path-to-regexp to version 8 means requiring Node versions >= 16, which means we would break compatibility with our supported versions (at the point of release of those major versions).