After further review, while there seems to be some questions still floating around about the viability of this CVE, the packages themselves were updated to protect against it, so not sure why they should not be mapped to this advisory.

Hi @aarongoldenthal and @darakian and @hauserkristof, yesterday #4713 was merged, which I guess is why GHSA-952p-6rrq-rcjv now says "Github Reviewed", and we've had one PR here to escalate this further #4714 .

There is feedback from the maintainer at micromatch/micromatch#264 (comment)

And my initial investigation concludes that they maintainer is correct that this advisory is problematic. micromatch/micromatch#264 (comment)

So, this CVE was assigned by Checkmarx
https://nvd.nist.gov/vuln/detail/CVE-2024-4067
if the goal is to get the CVE revoked then you should really reach out to them. That said, I think the best route forward from where we are is to wait for the 4.0.8 release and to update the advisory with that as a fixed release. Not ideal I know, but it seems like the least friction to me. Thoughts?

I have emailed Checkmarx just now.

Right on. Keep me in the loop and let me know how that line evolves. 👍

Thanks @jayvdb and @darakian. My goal wasn't specifically to get the CVE revoked, but until a few days ago the advisory had a reference to micromatch in the description, but not a mapping to the project, so tools like OSV Scanner that use this database were not flagging it (although tools like OWASP Dependency Check were). That discrepancy was really my concern, but that is resolved as of a few days ago (and it is being flagged).

I know there's a heated battle on whether it is or isn't a vulnerability, which I'm happy to let play out.