[Bug]: react-router seems to depend on vulnerable versions of path-to-regexp

[marekdano]

What version of React Router are you using?

react-router-dom v5.3.4

Steps to Reproduce

run npm audit report and get

# npm audit report

path-to-regexp  0.2.0 - 7.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/react-router/node_modules/path-to-regexp
  react-router  4.0.0-0 - 5.3.4
  Depends on vulnerable versions of path-to-regexp
  node_modules/react-router
    react-router-dom  4.0.0-beta.1 - 5.3.4
    Depends on vulnerable versions of react-router
    node_modules/react-router-dom

high severity vulnerabilities

Expected Behavior

The latest version of react-router-dom doesn't use a vulnerable version of path-to-regexp

Actual Behavior

npm audit report currently shows vulnerabilities.

[timdorr]

This is an older, unsupported version of the library, so we cannot fix this. The changes to path-to-regexp from version 2.x and beyond are major breaking changes.

The advisory gives mitigation steps, and this only applies to specific path patterns. If you're only using this client-side, there is no practical vulnerability at all.

[alecf]

There is now a v1.9.0 version of path-to-regexp that includes the security fix: https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0

[alecf]

I've created a PR against v5 here: #11980

[shreyas098]

Can you check this https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0? @timdorr

[asos-nikitaparamonov]

Please review this one #11980 - we kinda stuck in our pipelines, and not ready to update to 6.0.0 of react-router-dom

Appreciate it!

[shye0000]

@timdorr would you consider reopen this issue?knowing that there is a potential fix #11980, if it can be released soon would be great...

[timdorr]

This isn't a bug in the library. It's caused by something we're depending on, which they've released a newer version of the 1.x branch (1.9.0, specifically) that fixes the issue at hand. We don't have to make any changes to our code, as that version is allowed by the selector we use (^1.7.0).

github/advisory-database#4785 was just merged in, so it should disappear from npm audit soon as well.

[shye0000]

@timdorr Ah indeed, I just need to do a npm audit fix now. This is wonderful!