关于mocha@10.2.0依赖的inflight包高危漏洞（CWE-722）的修复方案咨询

Hey there, let’s work through how to fix this inflight vulnerability you’ve detected with mocha@10.2.0. Here are practical, actionable steps you can take:

• First, update mocha to the latest stable version
  Mocha’s maintainers might have already resolved this indirect dependency issue in a newer release. Run npm update mocha to pull the latest version, or manually edit your package.json to specify a more recent mocha version, then reinstall dependencies with npm install. After updating, re-run your Checkmarx scan to see if the vulnerability is gone—top-level packages often patch these kinds of issues by updating their own dependencies.

• Use package manager overrides to replace inflight
  Since inflight is unmaintained (version 1.0.6 is the latest, and no official fix exists for this memory leak), you can force your project to use a safer alternative. Inflight actually relies on once under the hood, which is a maintained package without this vulnerability. Here’s how to set this up:

  • For npm: Add an overrides section to your package.json:

    "overrides": {
      "inflight": "npm:once@^1.4.0"
    }
    

  • For Yarn: Use the resolutions field instead with the same mapping. After adding this, run npm install or yarn install to apply the change, then re-scan your project.

• Trace and update the intermediate dependency
  Run npm ls inflight to confirm exactly which package in mocha’s dependency tree is pulling in inflight. You mentioned node-glob uses inflight before version 8—if glob is the intermediate package, upgrading glob to v8+ will remove the inflight dependency entirely. You can do this via an override as well, or check if mocha has an update that uses the newer glob version.

• Keep an eye on mocha’s official updates
  Check mocha’s GitHub issues or release notes periodically. The team might release a patch for the 10.x branch that removes or replaces the inflight dependency, which would be the cleanest long-term fix.

A quick side note: While this memory leak is flagged as high-risk by Checkmarx, it’s often less impactful in short-lived processes like test runners (which mocha is). That said, addressing it is still a good idea to keep your project compliant with security standards.

备注：内容来源于stack exchange，提问作者Kathrine Breboneria