Skip to content

Commit

Permalink
deps: bump yargs ua-parser-js localtunnel http-proxy fs-extra chokidar
Browse files Browse the repository at this point in the history 
(cherry picked from commit 1ccf319)
  • Loading branch information
@shakyShane
shakyShane committed Nov 20, 2016
1 parent 75ad9b7 commit 8515664
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,16 +35,16 @@
"browser-sync-client": "^2.3.3",
"browser-sync-ui": "0.6.1",
"bs-recipes": "1.3.2",
"chokidar": "1.6.0",
"chokidar": "1.6.1",
"connect": "3.5.0",
"dev-ip": "^1.0.1",
"easy-extender": "2.3.2",
"eazy-logger": "3.0.2",
"emitter-steward": "^1.0.0",
"fs-extra": "0.30.0",
"http-proxy": "1.15.1",
"fs-extra": "1.0.0",
"http-proxy": "1.15.2",
"immutable": "3.8.1",
"localtunnel": "1.8.1",
"localtunnel": "1.8.2",
"micromatch": "2.3.11",
"opn": "4.0.2",
"portscanner": "^1.0.0",
Expand All @@ -56,8 +56,8 @@
"server-destroy": "1.0.1",
"socket.io": "1.6.0",
"socket.io-client": "1.6.0",
"ua-parser-js": "0.7.10",
"yargs": "6.0.0"
"ua-parser-js": "0.7.12",
"yargs": "6.4.0"
},
"devDependencies": {
"browser-sync-spa": "1.0.3",
Expand Down

3 comments on commit 8515664

@simonepri
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While installing browser-sync@2.18.2 from npm these changes are not avaible in the package.json
I think you need to npm publish it as browser-sync@2.18.3
screenshot- 35

@simonepri
Copy link

@simonepri simonepri commented on 8515664 Dec 10, 2016 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please do it asap since:
localtunnel@1.8.1 uses request@2.65.0
and request@2.65.0 uses tough-cookie@2.2.2
That generates:
npm WARN deprecated tough-cookie@2.2.2: ReDoS vulnerability parsing Set-Cookie https://nodesecurity.io/advisories/130

While localtunnel@1.8.2 uses request@2.78.0
and request@2.78.0 uses tough-cookie@3.1.2
that solves the ReDos vulnerability

Related:
#1158 #1170 #1187

@shakyShane
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simonepri browser-sync@2.18.4 is available now on NPM :)

Please sign in to comment.