Skip to content

Commit 640193d

Browse files
committed
Move @babel/cli from dependencies to devDependencies
@babel/cli is a build tool not used at runtime by consumers of this package. Having it in dependencies pulls in glob and minimatch as transitive deps, which carry high-severity ReDoS vulnerabilities (GHSA-3ppc-4f35-3m26). Moving it to devDependencies eliminates these vulnerabilities for all downstream consumers.
1 parent fd26d23 commit 640193d

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@
1616
"fs": false
1717
},
1818
"dependencies": {
19-
"@babel/cli": "^7.0.0",
2019
"superagent": "^6.1.0"
2120
},
2221
"devDependencies": {
22+
"@babel/cli": "^7.0.0",
2323
"@babel/core": "^7.0.0",
2424
"@babel/plugin-proposal-class-properties": "^7.0.0",
2525
"@babel/plugin-proposal-decorators": "^7.0.0",

0 commit comments

Comments
 (0)