Regular Expression Denial of Service (ReDoS) on dependency 'word-wrap'

[SharpFu]

Environment

Local ESLint version: 7.14.0
Global ESLint version: 7.14.0
Operating System: macos

What parser are you using?

Default (Espree)

What did you do?

Regular Expression Denial of Service (ReDoS) on dependency 'word-wrap'

What did you expect to happen?

when I use snyk check my project. and should not throw the error

What actually happened?

I am used "eslint": "^7.14.0" and when I use snyk check my project. and then throw a error as the image

Link to Minimal Reproducible Example

no example

Participation

• I am willing to submit a pull request for this issue.

Additional comments

No response

[mdjermanovic]

Hi @SharpFu, thanks for the issue!

This is a problem in a transitive dependency so it doesn't seem like there's anything we can do at this point. Also, according
to gkz/optionator#44 (comment) this isn't a possible problem for eslint users because the dependency in question is only used with predefined option descriptions, not with user input.

Given the above, I'm closing this issue. If and when the problem is fixed in the dependencies, we could update eslint's package.json if that would help remove the warning.

[c-harding]

Hi @nzakas When will this be released on npm?

[Rec0iL99]

Hi @nzakas When will this be released on npm?

You can track #17296

[lmplmplmp]

integrate to package.json. Works great!
"overrides": {
"optionator": "0.9.3"