Semver Dependency - CVE-2022-25883 Vulnerability

[7emretelli]

Hi! 👋

Firstly, thanks for your work on this project! 🙂

Today I used patch-package to patch [email protected] for the project I'm working on.

Semver, the dependent of the node-abi package has CVE-2022-25883 vulnerability. After carefully comparing 7.3.5 and 7.5.3 versions of the semver, concluded on there is no code updates needed but only version of semver need to be updated for node-abi.

NPM Audit: GHSA-c2qf-rxjj-qqgw

Here is the diff that solved my problem:

diff --git a/node_modules/node-abi/package.json b/node_modules/node-abi/package.json
index 1f462bf..1bc9e4e 100644
--- a/node_modules/node-abi/package.json
+++ b/node_modules/node-abi/package.json
@@ -32,7 +32,7 @@
     "tape": "^5.3.1"
   },
   "dependencies": {
-    "semver": "^7.3.5"
+    "semver": "^7.5.3"
   },
   "engines": {
     "node": ">=10"

This issue body was partially generated by patch-package.

[MarshallOfSound]

You don't need to use patch-package for this, those semver ranges are compatible and result in the same version being installed