Repository navigation
Semver package security issue #12
Description
The package semver version 5.4.1 has a security issue and allows attackers to do a ReDoS.
Can you please update that package to the latest version ?
https://github.com/serverless/serverless-plugin-log-retention/blob/master/package.json#L27
Activity
hashanotrium commentedon Aug 3, 2023
Any update here?
`npm audit
npm audit report
semver <5.7.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/serverless-plugin-log-retention/node_modules/semver
serverless-plugin-log-retention *
Depends on vulnerable versions of semver
node_modules/serverless-plugin-log-retention`
fedeam commentedon Aug 2, 2024
Any update here?
`npm audit
openam commentedon Aug 9, 2024
I ended up just using the built-in serverless log retentions settings, and stopped using this plugin, https://www.serverless.com/framework/docs/providers/aws/guide/functions#log-group-resources