fix: semver version

[TroyKomodo]

Expected Behavior

No CVEs

Current Behavior

Update Semver to patch CVE

pnpm audit
┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ semver vulnerable to Regular Expression Denial of      │
│                     │ Service                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ semver                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <7.5.2                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @commitlint/[email protected] > @commitlint/[email protected] > │
│                     │ @commitlint/[email protected] > [email protected]           │
│                     │                                                        │
│                     │ . > [email protected] > @commitlint/[email protected] >       │
│                     │ @commitlint/[email protected] >                              │
│                     │ @commitlint/[email protected] > [email protected]           │
│                     │                                                        │
│                     │ . > @commitlint/[email protected] > @commitlint/[email protected] > │
│                     │ @commitlint/[email protected] >                             │
│                     │ [email protected] > [email protected] >       │
│                     │ [email protected] > [email protected] >                   │
│                     │ [email protected] > [email protected]            │
│                     │                                                        │
│                     │ ... Found 6 paths, run `pnpm why semver` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2qf-rxjj-qqgw      │
└─────────────────────┴────────────────────────────────────────────────────────┘
2 vulnerabilities found
Severity: 2 moderate

Affected packages

• cli
• core
• prompt
• config-angular

Possible Solution

N/A

Steps to Reproduce

N/A

Context

N/A

commitlint --version

@commitlint/[email protected]

git --version

2.34.1

node --version

v18.16.0

[escapedcat]

https://github.com/conventional-changelog/commitlint/releases/tag/v17.6.6

[TroyKomodo]

@escapedcat It seems that some packages are still out of date

┌─────────────────────┬────────────────────────────────────────────────────────┐
│ moderate            │ semver vulnerable to Regular Expression Denial of      │
│                     │ Service                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Package             │ semver                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Vulnerable versions │ <7.5.2                                                 │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Patched versions    │ >=7.5.2                                                │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ Paths               │ . > @commitlint/[email protected] > @commitlint/[email protected] > │
│                     │ @commitlint/[email protected] >                             │
│                     │ [email protected] > [email protected] >       │
│                     │ [email protected] > [email protected] >                   │
│                     │ [email protected] > [email protected]            │
│                     │                                                        │
│                     │ . > @commitlint/[email protected] > @commitlint/[email protected] > │
│                     │ [email protected] > [email protected] >                  │
│                     │ [email protected] > [email protected] >                   │
│                     │ [email protected] > [email protected]            │
│                     │                                                        │
│                     │ . > [email protected] > @commitlint/[email protected] >       │
│                     │ @commitlint/[email protected] > @commitlint/[email protected] >   │
│                     │ [email protected] > [email protected] >       │
│                     │ [email protected] > [email protected] >                   │
│                     │ [email protected] > [email protected]            │
│                     │                                                        │
│                     │ ... Found 4 paths, run `pnpm why semver` for more      │
│                     │ information                                            │
├─────────────────────┼────────────────────────────────────────────────────────┤
│ More info           │ https://github.com/advisories/GHSA-c2qf-rxjj-qqgw      │
└─────────────────────┴────────────────────────────────────────────────────────┘

https://www.npmjs.com/package/conventional-commits-parser
https://www.npmjs.com/package/git-raw-commits

[escapedcat]

Ah thanks, wanna open a PR for these?

[escapedcat]

Just saw these are coming from conventional-changelog not commitlint.
An issue already exists: conventional-changelog/conventional-changelog#1019