Bump debug to ^4.3.1 (#16164)

martinez-hugo · web-flow · commit cce807f1eb63 · 2023-12-08T12:38:31.000-05:00
* Fix Regular Expression Denial of Service in debug

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

This was later re-introduced in version v3.2.0, and then repatched in versions 3.2.7 and 4.3.1.

* Fix yarn process
diff --git a/packages/babel-traverse/package.json b/packages/babel-traverse/package.json
@@ -24,7 +24,7 @@
     "@babel/helper-split-export-declaration": "workspace:^",
     "@babel/parser": "workspace:^",
     "@babel/types": "workspace:^",
-    "debug": "^4.1.0",
+    "debug": "^4.3.1",
     "globals": "condition:BABEL_8_BREAKING ? ^13.5.0 : ^11.1.0"
   },
   "devDependencies": {
diff --git a/yarn.lock b/yarn.lock
@@ -4304,7 +4304,7 @@ __metadata:
     "@babel/helper-split-export-declaration": "workspace:^"
     "@babel/parser": "workspace:^"
     "@babel/types": "workspace:^"
-    debug: "npm:^4.1.0"
+    debug: "npm:^4.3.1"
     globals: "condition:BABEL_8_BREAKING ? ^13.5.0 : ^11.1.0"
   languageName: unknown
   linkType: soft
@@ -8095,7 +8095,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"debug@npm:4, debug@npm:4.3.4, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.2, debug@npm:^4.3.4":
+"debug@npm:4, debug@npm:4.3.4, debug@npm:^4.1.0, debug@npm:^4.1.1, debug@npm:^4.3.1, debug@npm:^4.3.2, debug@npm:^4.3.4":
   version: 4.3.4
   resolution: "debug@npm:4.3.4"
   dependencies:
