Semver , 7 moderate severity vulnerabilities

Question

I have a problem with a ViteJS project, I have 7 moderate vulnerabilities with Semver:

# npm audit report

semver  <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/@babel/core/node_modules/semver
node_modules/@babel/helper-compilation-targets/node_modules/semver
node_modules/eslint-plugin-import/node_modules/semver
node_modules/eslint-plugin-jsx-a11y/node_modules/semver
node_modules/eslint-plugin-react/node_modules/semver
  @babel/core  *
  Depends on vulnerable versions of @babel/helper-compilation-targets
  Depends on vulnerable versions of semver
  node_modules/@babel/core
    @babel/helper-compilation-targets  *
    Depends on vulnerable versions of @babel/core
    Depends on vulnerable versions of semver
    node_modules/@babel/helper-compilation-targets
    @vitejs/plugin-react  *
    Depends on vulnerable versions of @babel/core
    node_modules/@vitejs/plugin-react
  eslint-plugin-import  >=2.27.4
  Depends on vulnerable versions of semver
  node_modules/eslint-plugin-import
  eslint-plugin-jsx-a11y  >=6.6.0
  Depends on vulnerable versions of semver
  node_modules/eslint-plugin-jsx-a11y
  eslint-plugin-react  7.19.0 || >=7.26.0
  Depends on vulnerable versions of semver
  node_modules/eslint-plugin-react

7 moderate severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

I tried to add:

"resolutions": {
    "semver": "^7.5.3"
  }

On my package.json to delete the node_modules and the package-lock.json but nothing to do it does not work, do you have an idea?

Is it possible to update shared dependencies to use the latest version of Semver?

Answer 1

Adding this in package.json should do it:

"overrides": {
    "semver": "~7.5.2"
  }

Note: This may cause other issues as you're overriding the Vite default, so worth manually testing things afterwards.