semver vulnerable to Regular Expression Denial of Service

[1EDExg0ffyXfTEqdIUAYNZGnCeajIxMWd2vaQeP]

The semver package has a security vulnerability. They only fixed v7, but the babel team has backported the fix to semver v6, can we use that? babel/babel#15742

npm audit output

# npm audit report

semver  <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix --force`
node_modules/eslint-plugin-jsx-a11y/node_modules/semver
  eslint-plugin-jsx-a11y  >=6.6.0
  Depends on vulnerable versions of semver
  node_modules/eslint-plugin-jsx-a11y

[ljharb]

It’s not a really a vulnerability - like most JS CVEs, it’s a false positive - and we can’t upgrade to v7. I’d rather not use a fork, and would instead prefer to wait until semver backports it to v6, since it’s not an actual vuln.