ForbesLindesay / browserify-middleware

express middleware for browserify, done right
http://browserify.org
MIT License
381 stars 66 forks source link

please update watchify to fix CVE-2020-28469 #133

Open sseide opened 3 years ago

sseide commented 3 years ago

browserify-middleware requires older 3.x version of watchify that depends on old chokidar releases fetching an insecure version of glob-parent without any change to update to the fixed glob-parent release. This dependency problem is resolved with updating watchify to current version.

Updating watchify to current 4.0 release requires at least NodeJS 8.x - but 8.x is End-Of-Life by now without any fixes whatsoever, there should not be any problem.

Thanks