[MelvinBot]

Details

Bumps transitive flatted 3.2.7 → 3.4.4 in package-lock.json. Parent flat-cache allows ^3.1.0, so no package.json change or override is needed. Fixes Dependabot alerts #39 (DoS from unbounded recursion in parse()) and #42 (prototype pollution in parse()).

Usage: This library's code doesn't use it. It's a dev-only transitive dependency: eslint → file-entry-cache → flat-cache, which uses it to read and write the ESLint --cache file. It isn't shipped in dist.

Change Log

• 3.2.8: $value made an explicit class field
• 3.2.9–3.2.13: Python port; better TS types; jsr publishing
• 3.3.0–3.3.3: TS definition fixes; __pycache__ removed from npm; explicit files
• 3.3.4: Go port added
• 3.4.0: security: parse() no longer recurses (DoS fix)
• 3.4.1: same recursion fix in Python
• 3.4.2: security: prototype pollution fix (CWE-1321)
• 3.4.3: allows null as the replacer value
• 3.4.4: Go/PHP CI fixes

Related Issues

https://github.com/Expensify/Expensify/issues/695895

Manual Tests

1. Run npm ci. It succeeds, and npm ls flatted shows 3.4.4.
2. Run npm audit. It shows no flatted advisories.
3. Run npx eslint --cache src twice. Both runs pass, and the second run reads the cache.
4. Run npm run ts and npm run build. Both pass.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR