Update tsconfig-paths to latest fix

[commit-master]

Hi,

Thanks again for this wonderful package. A security vulnerability has been discovered for the minimist package. tsconfig-paths makes use of it, they have update their package to fix the issue. Could you be so kind and update this package to the latest fix?

More info here: GHSA-vh95-rmgr-6w4m
tsconfig-paths package.json: https://github.com/dividab/tsconfig-paths/blob/master/package.json

Thanks again.

[JounQin]

We're using tsconfig-paths: "^3.9.0" which should cover the latest version, if you want to ensure the version of tsconfig-paths to be the latest, just reinstall eslint-import-resolver-typescript, you'll get it.

See also #86 (comment)

[commit-master]

Thanks for the quick reply.
I'm currently on v2.5.0 which seems to be the latest version.

tsconfig-paths@3.9.0 is using an old and vulnerable minimist dependency (see below)
https://github.com/dividab/tsconfig-paths/blob/287867d1140c14366f280910099938c5c0976f3c/package.json#L33

They just updated this vulnerability fix a few hours ago in the v3.14.1:
dividab/tsconfig-paths@22b9d74

Thanks.

[JounQin]

Again, ^3.9.0 covers 3.14.1, just reinstall this package, pls.

[commit-master]

This is very confusing.

Removing the package-lock and node modules and re-installing does not change anything since this is a sub-dependency. Am I missing something here ?

To me the best way to handle this would be updating your dependencies on this project and then running an npm update on my end.

I don't think you can currently update a sub-dependency on a project.

I'd be happy to submit a PR for this if you want.

[JounQin]

npm uninstall eslint-import-resolver-typescript && npm install -D eslint-import-resolver-typescript have you ever tried it? ^3.9.0 will resolve the latest version of tsconfig-paths on the new installation.

[commit-master]

I did yes, as well as deleting node_modules and the package-lock.json. After running a npm audit the vulnerability is still flagged:

[JounQin]

@commit-master v2.6.0 released.

[commit-master]

Thanks a lot !