Set the threshold to "moderate" and above. Currently msvc-dev-cmd has
an issue in transitive dev-dependency "minimist" [1] via somewhat long
chain of dependencies:
- eslint > file-entry-cache > flat-cache > write > mkdirp > minimist
- eslint > mkdirp > minimist
In order for this to be resolved all these packages need to do something
about their pinned versions. I don't want to sit there with a red build
because of some possible low-severity prototype pollution in dev
dependency. Anything higher -- okay, I'll look at at, and apply a fix
if necessary. (Maybe we should not audit dev dependencies at all...)
This particular vulnerability can be exploited by an attacker who can
submit a pull request and do "something bad"™ to Actions runners
executing jobs for this repository. However, since it's a dev
dependency, nothing will happen to our users. So we can safely ignore
this advisory.
[1]: https://npmjs.com/advisories/1179
I'd like to be notified about weird vulnerabilities in JavaScript
libraries for the release branch as well. It's double important
since the release branch ships particular pinned version of *all*
dependencies.
Ewout ter Hoeven
ilammy