Vulnerbility found in ws

[fiskgrodan]

What version of Livereload are you using?

^0.7.0

Installed as a dependecy to rollup-plugin-livereload
https://github.com/thgh/rollup-plugin-livereload/blob/master/package.json

What OS are you using?

macOS / GitHub

What web browser are you using? (Browser name and specific version please)

Expected result

To not get a vulnerbility warning

Actual result

Getting vulnerbility warnings in terminal and in the GitHub GUI.

This is the warning I get when installing:

+ rollup-plugin-livereload@1.0.0
added 241 packages from 138 contributors and audited 1219 packages in 5.31s
found 1 low severity vulnerability
  run `npm audit fix` to fix them, or `npm audit` for details

I get these warnings in the GitHub GUI:

Steps to reproduce issue

I installed it from this repo:
https://github.com/sveltejs/template

With these steps:

1. npx degit sveltejs/template svelte-app
2. npm install

Why is this important?

Vulnerbility warnings give a bad impression and might scare of possible users. Maybe upgrading the ws module could fix the issue?

[napcs]

@fiskgrodan LiveReload v0.8.0 was released last week.

Running npm audit on Master currently shows no vulns:

                       === npm audit security report ===

found 0 vulnerabilities
 in 2233 scanned packages

I'll continue to monitor this.

[oliverxchen]

The commit linked to in the Github security report is: websockets/ws@c4fe466

After creating the PR, I read down further into the comments and found this: websockets/ws@c4fe466#commitcomment-28951427 which reports that 1.1.5 is not vulnerable. So maybe Github has it wrong?

[larafale]

same here, came from rollup-plugin-livereload@1.0.1 which use livereload@0.8.0, and pushing my repo to github gave me a security alert (high), which can be resolved by upgrading ws to 3.3.1.

bummer, because running npm audit on both livereload@master & rollup-plugin-livereload@1.0.1 and also my project return found 0 vulnerabilities

the joy of programming :)

[napcs]

Ok. I'll take everyone's word for it. Lemme make sure #131 resolves this properly and I'll package up a new release this week.

[larafale]

that would be awesome, thanks !

[larafale]

hello again @napcs, just a little reminder about that one ^^
I'll buy you a beer anytime :)
thanks, take care !

[napcs]

Closed by #131. 0.8.1 released

[larafale]

you've made my day :) thanks a lot