Comment on github Cryptiles security issue - waiting on Hapijs to be updated

[jkbits1]

The package 3.1.2 is a dependency of hapi 16.6.3 - a supported and maintained version of hapi (not 17, which is the latest).

This seems reasonably benign in the short term - and we are not using the affected function call directly. Hapijs haven't issued a warning on this themselves.

The only resolution available currently is to update to v17, which is a fairly hefty breaking change.

If there are other thoughts or comments, please add them below.