Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade dependencies: security vulnerability in braces < 2.3.1, brfs < 2.0.1 #362

Merged
merged 1 commit into from
Feb 19, 2019
Merged

Conversation

velfundert
Copy link
Contributor

Upgrade dependencies for watchify to mitigate security vulnerabilities detected by npm audit:

Upgrade https://github.com/micromatch/anymatch and https://github.com/paulmillr/chokidar to newest release versions, in order to fix a security vulnerability caused by https://github.com/micromatch/braces < 2.3.1: https://www.npmjs.com/advisories/786

Upgrade https://github.com/browserify/brfs to 2.0.1 to fix security vulnerability caused by https://github.com/browserify/static-eval: https://www.npmjs.com/advisories/758

@velfundert velfundert changed the title upgrade dependencies: security vulnerability in braces < 2.3.1 upgrade dependencies: security vulnerability in braces < 2.3.1, brfs < 2.0.1 Feb 18, 2019
@ankurkaushal360
Copy link

I was just about to open a PR for this. Can we get this one merged please? Also, I think @velfundert you should bump minor version for the watchify itself.

Just my two cents. :)

@goto-bus-stop
Copy link
Member

I'll try to merge it later today...please don't bump the version field, that'll be done in a separate commit to master :)

Fwiw, neither vulnerability actually applies to watchify, so don't worry about using it in the mean time

@goto-bus-stop goto-bus-stop merged commit e90101b into browserify:master Feb 19, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants