Comment # 2 on bug 1224385 from Scott Bradnick

(In reply to Gabriele Sonnu from comment #1)
> Vulnerable versions of the micromatch package are embedded in:
> 
> - openSUSE:Factory/xpra-html5  micromatch (4.0.5)
> 
> Upstream issue:
> 
> https://github.com/micromatch/micromatch/issues/243

Talking with xpra-html5 upstream maintainer about this one too in:
https://github.com/Xpra-org/xpra-html5/issues/306