Comment by hombre_fatal
Comment by hombre_fatal 10 months ago
Tbf those are development deps rather than production server deps, and the vuln will be something like "DOS possible if you let users craft their own regex string as input to lib.foo(re) in a server ctx" rather than "by using this in development to build your static js app, people get remote access to your dev machine."
It is a bit silly then that it reports them as vulnerabilities by default.