fix(deps): upgrade semver dependency to >=7.5.2 (CVE-2022-25883)

[tupe12334]

Summary

The package currently declares "semver": "^6.3.1" as a dependency. All versions of semver prior to 7.5.2 are affected by a Regular Expression Denial of Service (ReDoS) vulnerability.

Vulnerability Details

• CVE: CVE-2022-25883
• Affected versions: semver < 7.5.2
• CVSS score: 5.3 (Medium)
• Impact: The semver package uses a vulnerable regular expression when parsing version strings. A specially crafted input can cause catastrophic backtracking, leading to excessive CPU consumption and denial of service.
• Published: 2023-06-21

Current State

node-exports-info@1.6.0 ships:

"semver": "^6.3.1"

Because the ^6 range can never resolve to >=7.5.2, all installs of this package remain on a vulnerable semver release.

Note: Renovate has already queued a pending-approval branch to bump semver to v7 (tracked in the Dependency Dashboard issue #1), but that PR has not yet been approved or merged.

Fix

Bump the semver dependency to >=7.5.2 (or ^7.5.2 / ^7.6.0):

"semver": "^7.5.2"

Semver v7 is a drop-in replacement for v6 for all public API surface used by this package.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25883
• GHSA-c2qf-rxjj-qqgw
• https://github.com/npm/node-semver/security/advisories/GHSA-c2qf-rxjj-qqgw
• https://github.com/npm/node-semver/releases/tag/v7.5.2

[tupe12334]

Context & Follow-up: PR #4 Opened with Fix

Background: This issue was filed as part of a security audit identifying packages with a vulnerable version of semver (CVE-2022-25883, ReDoS vulnerability). The affected version is semver@6.3.1 (used here as a direct dependency). Downstream consumers of node-exports-info must currently apply package manager overrides to force semver >=7.5.2 — this PR removes that burden.

PR #4 has been opened with the fix: #4

What the PR changes and why

1. semver bumped to ^7.5.2 — the minimum version that patches CVE-2022-25883.
2. engines.node bumped from >=0.4 to >=10 — semver@7 itself requires Node >=10. Without updating engines, the CI engines check (run via ls-engines) correctly detects a mismatch between the declared engine range and the dependency graph, and fails. This was the root cause of 15 CI failures observed on the initial run and is a required accompanying change.
3. @types/semver bumped from ^6.2.7 to ^7.5.0 — the type definitions must match the new runtime major version.

Relationship to Renovate / Dependency Dashboard (#1)

A Renovate PR tracking the semver version bump was already present in the repository's Dependency Dashboard (issue #1). PR #4 formalises that bump as an explicit security fix with full context and explanation, rather than a routine dependency update.

---

Full disclosure: This issue and PR were created by Claude Code (Anthropic's AI coding assistant), supervised and reviewed by a human developer (GitHub user: tupe12334). The security audit, research, and authorship were AI-assisted. We believe transparency about AI involvement is important.

[ljharb]

This CVE is a false positive, since we don't pass untrusted input into semver. The fix is simply to ignore this warning.

Separately, please don't use an LLM to automate OSS contributions; the output isn't copyrightable and you don't have the legal capability of contributing it.