page.js >=1.4.0 depends on vulnerable versions of path-to-regexp

[MarkBFamFour]

Hi,

Recently I started getting high severity warnings from npm that this library depends on vulnerable versions of path-to-regexp (in my case page.js 1.11.6 depends on path-to-regexp 1.2.1). Could this be remedied, or can I upgrade to path-to-regexp 1.9.0 for example to provide a secure path-to-regexp library for page.js?

[crisward]

Not sure if you've got around to fixing this. But one workaround is to use npm overrides.

More info here - https://medium.com/microsoftazure/how-to-fix-your-security-vulnerabilities-with-npm-override-c4b5be0ab4f6

For page.js the following should work ( you may need to change the version numbers based on the error)

  "overrides": {
    "path-to-regexp@1.2.1": "1.9.0"
  },