Security maintenance: Review outdated npm development dependencies

[gitbyapp]

Summary

During a source-code review of gorhill/uBlock, I noticed that package-lock.json pins several npm development-tooling dependencies to versions affected by published security advisories.

This is a maintenance concern rather than a claim of an exploitable vulnerability in the distributed uBlock Origin browser extension.

Affected dependencies

Package	Locked version	Patched version (same major line)
brace-expansion	1.1.12	1.1.18
minimatch	3.1.2	3.1.4
flatted	3.3.3	3.4.2
js-yaml	4.1.0	4.3.0

Source: https://github.com/gorhill/uBlock/blob/master/package-lock.json

Security advisories:

• GHSA-rgw5-rvv9-x895
• GHSA-23c5-xmqv-rm74
• GHSA-rf6f-7fwh-wjgh
• GHSA-52cp-r559-cp3m

Scope and impact

These are transitive development dependencies associated with npm tooling. I have not established that attacker-controlled input reaches these packages during normal development or CI execution.

I also have not identified an exploitable vulnerability in the browser extension itself.

Suggested review

Would the maintainers consider refreshing the affected development dependencies and regenerating package-lock.json?

Running npm audit and the project's lint/build checks could help confirm the dependency findings and ensure that updates do not introduce regressions.

I have not executed npm audit locally, so this report is based on inspection of the repository's dependency versions and published advisories.

Thank you for maintaining uBlock Origin.

[freezer2022]

A duplicate of / similar to:

• Build fails on Node 20 with ESM errors #4106 (comment)

[gitbyapp]

Thanks for pointing this out. I reviewed #4106 and the linked comment. That issue primarily concerns a Node.js build failure and npm package maintenance, whereas this discussion specifically addresses outdated development dependencies in package-lock.json.

Raymond Hill has since updated the affected dependencies in commit 13ff816, resolving the specific versions reported here. Appreciate the reference!

[gorhill]

Thanks for the heads up, I ran npm audit fix: gorhill/uBlock@13ff816

[gitbyapp]

Thank you for looking into this and addressing it so quickly!

I've reviewed commit 13ff816 and confirmed that all four reported dependencies (brace-expansion, minimatch, flatted, and js-yaml) have been updated to newer versions.

This addresses the specific dependency concerns raised in the discussion. I appreciate your prompt response and your continued work maintaining uBlock Origin!