Dependency Security: js-beautify pulls vulnerable minimatch (ReDoS)

[Razerspine]

Hello! I'm using pug-plugin@6.0.0 in a monorepo. Currently, js-beautify depends on older versions of glob and editorconfig, which in turn pull minimatch < 10. This triggers a ReDoS vulnerability advisory.

To fix this, I have to use manual overrides in package.json to force minimatch@10 and glob@13.

Are there any plans to update the js-beautify dependency or switch to a more secure formatter (like Prettier) to resolve this transitive vulnerability?

[webdiscus]

Hallo @Razerspine,

thanks for the issue. I will update all dependencies to actual versions at WE.

[webdiscus]

Hello @Razerspine,

sorry for delay. The fix is released in v6.1.0.

I have updated js-beautify to the latest version and added overrides to package.json:

  "overrides": {
    "minimatch": "^10.0.0",
    "glob": "^13.0.0"
  }

[Razerspine]

Hi @webdiscus ,

Thank you so much for the quick turnaround and for releasing v6.1.0!

I really appreciate the fix. To be honest, I was using the exact same overrides workaround in my own package.json to suppress the warnings before this update.

While this resolves the immediate ReDoS advisory, using overrides feels a bit like a temporary band-aid. The root of the problem is that js-beautify itself hasn't been actively updated in a while and continues to rely on outdated, insecure dependencies out of the box.

Do you think migrating to a more actively maintained formatter (like Prettier or similar) could be an option for a future major release of the plugin?

Thanks again for your hard work and for maintaining this awesome plugin!

[webdiscus]

Hi @Razerspine,

Thanks for the feedback!
Currently, I may be very slow to migrate from js-beautify to any other formatter (e.g. Prettier is good alternate) on my own.
Any PR is very welcome!