IssueTracker

Some vulnerabilities have been found in the dependencies. Severity is from Moderate to Critical. Does LLVM org have any plan on updating the dependencies?  

## minimatch (npm) < 3.0.5
A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

[mlir/utils/vscode/package-lock.json ](https://github.com/llvm/llvm-project/blob/main/mlir/utils/vscode/package-lock.json)
[llvm/utils/vscode/llvm/package-lock.json](https://github.com/llvm/llvm-project/blob/main/llvm/utils/vscode/llvm/package-lock.json)

## minimist (npm) < 0.2.4
Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). (< 0.2.4)

Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity. (< 0.2.1)

[llvm/utils/vscode/llvm/package-lock.json](https://github.com/llvm/llvm-project/blob/main/llvm/utils/vscode/llvm/package-lock.json)

## certifi (pip) < 2022.12.07
Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store.

TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ).

[llvm/utils/git/requirements.txt](https://github.com/llvm/llvm-project/blob/main/llvm/utils/git/requirements.txt)

## qs (npm) < 6.10.3
qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.

[mlir/utils/vscode/package-lock.json](https://github.com/llvm/llvm-project/blob/main/mlir/utils/vscode/package-lock.json)

## path-parse (npm) < 1.0.7
Affected versions of npm package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

[llvm/utils/vscode/llvm/package-lock.json](https://github.com/llvm/llvm-project/blob/main/llvm/utils/vscode/llvm/package-lock.json)

## xml2js (npm) < 0.5.0
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

The latest possible version that can be installed is 0.4.23 because of the following conflicting dependencies:

```
vsce@2.7.0 requires xml2js@^0.4.23
No patched version available for xml2js
```

The earliest fixed version is 0.5.0.

[mlir/utils/vscode/package-lock.json](https://github.com/llvm/llvm-project/blob/main/mlir/utils/vscode/package-lock.json)