I'm having the same issue over Mend scan as high finding. Thanks

Our package.json lists a non-specific version so it should allow you to upgrade it locally:

Include everything greater than a particular version in the same minor range

As can be tested here 4.0.8 is also matched: https://semver.npmjs.com/

In my project there was only one vulnerability issue related to this and the npm audit fix command helped to resolve it and setup correct version.

you are right so as this is only patch version and lint-staged uses ~ there is no problem here

@iiroj Is it possible to bump micromatch version to the latest for lint-staged v14?

@ilya-byborg I don't want to spend time updating micromatch because honestly I think these vulnerabilities are more theoretical than anything. It has had multiple "high" or "critical" vulnerabilities but in the end it's about the file globs you configure in your own lint-staged config.

I'll update the minimum version to ~4.08 along with other dependencies in the next update to v15 (or v16).

Lint-staged 13.3.0 has a pinned version dependency on micromatch

This has been reverted in 15.2.5

Those that want to use micromatch without the warning should avoid any release in between those versions.