High severity dependency `path-to-regexp`

[Juraj-Masiar]

npm audit report

path-to-regexp 0.2.0 - 7.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - GHSA-9wv6-86v2-598j
fix available via npm audit fix --force
Will install serve@6.5.8, which is a breaking change

node_modules/path-to-regexp
  serve-handler  *
  Depends on vulnerable versions of path-to-regexp
  node_modules/serve-handler
    serve  >=7.0.0
    Depends on vulnerable versions of serve-handler
    node_modules/serve

[MikeMcC399]

• Also added to High severity vulnerabilities / serve-handler / path-to-regexp serve#811 where serve-handler is used.

The last version of serve-handler was released almost two years ago. Is anybody maintaining this repo these days?

[oskarwilliams]

@leo I see you are the owner, would this be something you can do?

[leo]

Hey!

The package is maintained by Vercel. I'm no longer part of the Vercel team.

[thomashohn]

@AndyBitz - Can you update this package or who to contact @vercel?

[MikeMcC399]

@AndyBitz

Is there a chance you could also resolve this issue whilst you are updating the repo at the moment?