CVE-2024-11831

[farrukhishaq]

CVE-2024-11831
upgrade nodemon version:
the semver package is included as a dependency through simple-update-notifier, which is used by nodemon. The versions of simple-update-notifier between 1.0.7 and 1.1.0 depend on vulnerable versions of semver.

[parvinba]

This issue is likely caused by asp-service repo. That repo is using terser-webpack-plugin 4.2.3 which adds old version serialize-javascript
< 6.0.2.

It can use 5.3.10 version which uses version > 6.0.2 of serialize-javascript