Environment

• nodemon -v: 2.0.15
• node -v: v14.18.1
• Operating system/terminal environment: macOS 12.5

Issue

nodemon@2.0.15 requires got@^9.6.0 via a transitive dependency on package-json@6.5.0

• Vulnerabilty: The got package before 12.1.0 for Node.js allows a redirect to a UNIX socket.
• Affected Versions: >= 12.0.0, < 12.1.0, < 11.8.5
• Patched versions: 12.1.0, 11.8.5
• References
  • GHSA-pfrx-2q88-qq97
  • https://nvd.nist.gov/vuln/detail/CVE-2022-33987
  • Disable redirects to UNIX sockets sindresorhus/got#2047
  • sindresorhus/got@v12.0.3...v12.1.0
  • sindresorhus/got@861ccd9
  • https://github.com/sindresorhus/got/releases/tag/v11.8.5
  • https://github.com/sindresorhus/got/releases/tag/v12.1.0

Possible fix

• Upgrade dependency version of package-json to >=8.0.0 as it points to fixed dependency for got >12.1.0