[BUG] Moderate vulnerability in @refinedev/[email protected]

[bombillazo]

Describe the bug

There is a moderate vulnerability on @refinedev/[email protected]

send  <0.19.0
Severity: moderate
send vulnerable to template injection that can lead to XSS - https://github.com/advisories/GHSA-m6fv-jmcg-4jfg
fix available via `npm audit fix --force`
Will install @refinedev/[email protected], which is a breaking change
node_modules/serve-static/node_modules/send
  serve-static  <=1.16.0
  Depends on vulnerable versions of send
  node_modules/serve-static
    express  4.0.0-rc1 - 5.0.0-beta.3
    Depends on vulnerable versions of serve-static
    node_modules/express
      @refinedev/cli  >=2.5.4
      Depends on vulnerable versions of @refinedev/devtools-server
      Depends on vulnerable versions of express
      node_modules/@refinedev/cli
      @refinedev/devtools-server  *
      Depends on vulnerable versions of express
      node_modules/@refinedev/devtools-server

Steps To Reproduce

N/A

Expected behavior

No vulnerability is present, use updated package

Packages

• @refinedev/cli

Additional Context

No response

[aliemir]

Hey @bombillazo thank you for reporting! Looks like serve-static just had a bump to fix the vulnerability and express also had a release 10 hours ago with the fixed version (Check out [email protected]) We don't pin the express version in @refinedev/cli and @refinedev/devtools-server so having a clean install without a lock file may upgrade it to latest. 🚀

Still, we can upgrade the version number to the fixed version in our package.json files. Would you like to work on this? We'd love to see your PR 🙏

[arndom]

@bombillazo can I work on this if you're unavailable