Update dependency semver to v5.7.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
semver	5.7.0 → 5.7.2

---

semver vulnerable to Regular Expression Denial of Service

CVE-2022-25883 / GHSA-c2qf-rxjj-qqgw

More information

Details

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-25883
• https://github.com/npm/node-semver/pull/564
• https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441
• https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795
• https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104
• https://github.com/npm/node-semver/blob/main/internal/re.js#L138
• https://github.com/npm/node-semver/blob/main/internal/re.js#L160
• https://github.com/npm/node-semver/pull/585
• https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c
• https://github.com/npm/node-semver/pull/593
• https://github.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0
• https://github.com/npm/node-semver/blob/main/classes/range.js%23L97-L104
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L138
• https://github.com/npm/node-semver/blob/main/internal/re.js%23L160
• https://security.netapp.com/advisory/ntap-20241025-0004
• https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

npm/node-semver (semver)

v5.7.2

Compare Source

Bug Fixes

• 2f8fd41 #​585 better handling of whitespace (#​585) (@​joaomoreno, @​lukekarrys)

v5.7.1

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.