🐛 [BUG]: path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j No fix available

[Samuel-Muriuki]

🐛 bug 描述

I am using antd@5.21.4 with react@18.3.1 and getting vulnerabilities notification.

📷 复现步骤 | Recurrence steps

$ npm audit
# npm audit report

path-to-regexp 2.0.0 - 3.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - GHSA-9wv6-86v2-598j
No fix available
node_modules/@refinedev/antd/node_modules/path-to-regexp
@ant-design/pro-layout <=4.3.2 || 4.7.3 - 7.20.0
Depends on vulnerable versions of path-to-regexp
node_modules/@refinedev/antd/node_modules/@ant-design/pro-layout
**@refinedev/antd ***
Depends on vulnerable versions of @ant-design/pro-layout
node_modules/@refinedev/antd

3 high severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

$ npm ls path-to-regexp
my-project
├─┬ @refinedev/antd@5.43.1
│ └─┬ @ant-design/pro-layout@7.17.12
│ └── path-to-regexp@2.4.0
└─┬ @refinedev/cli@2.16.39
└─┬ @refinedev/devtools-server@1.1.37 invalid: "1.1.36" from node_modules/@refinedev/devtools
└─┬ express@4.21.1
└── path-to-regexp@0.1.10

$ npm ls send
my-project
└─┬ @refinedev/cli@2.16.39
└─┬ @refinedev/devtools-server@1.1.37 invalid: "1.1.36" from node_modules/@refinedev/devtools
└─┬ express@4.21.1
├── send@0.19.0
└─┬ serve-static@1.16.2
└── send@0.19.0 deduped

🏞 期望结果 | Expected results

💻 复现代码 | Recurrence code

© 版本信息

• Ant Design Pro 版本: [e.g. 4.0.0]
• umi 版本
• 浏览器环境
• 开发环境 [e.g. mac OS]

🚑 其他信息