security: potential vulnerability

[Infuser]

Bug Description

There is low known vulnerability in @theia/application-package from a nested dependency:

=== npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ debug                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >= 2.6.9 < 3.0.0 || >= 3.1.0                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @theia/application-package                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @theia/application-package > changes-stream > debug          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/534                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 80 scanned packages

[vince-fugnitto]

@Infuser please note that vulnerabilities should not be disclosed publicly, we have a pull-request in review with the proper steps to report:

• https://github.com/eclipse-theia/theia/pull/9804/files

[Infuser]

Apologies and point noted Vince, assume you will now relay the issue and get it resolved

Thanks

[vince-fugnitto]

@Infuser my apologies about deleting the initial comment, for known vulnerabilities it is fine, but for newly disclosed vulnerabilities we should follow the proper procedure. Any reason as to why this low vulnerability was of interest to you? We try our best to resolve such vulnerabilities but we prioritize those that are of moderate or higher severity.

[Infuser]

Hi Vince

Its just our company policy to resolve them, not too worry its not a major problem for us but would be good to see it resolved in the next 6 months

[vince-fugnitto]

Its just our company policy to resolve them, not too worry its not a major problem for us but would be good to see it resolved in the next 6 months

@Infuser please don't hesitate in contributing updates to this dependency and others if you're interested 👍

[vince-fugnitto]

The vulnerability was fixed thanks to #10764.