Update Browsersync to resolve `axios` vulnerability

alphagov / govuk-prototype-kit

Rapidly create HTML prototypes of GOV.UK services

https://prototype-kit.service.gov.uk

MIT License

303 stars 236 forks source link

Update Browsersync to resolve `axios` vulnerability #2394

Closed colinrotherham closed 6 months ago

colinrotherham commented 6 months ago

See GitHub Advisory: https://github.com/advisories/GHSA-wf5p-g6vw-rhxx

This PR also runs npm update --save to pick up minor/patch versions for other packages

Closes https://github.com/alphagov/govuk-prototype-kit/issues/2383

Browsersync update

Updating from browser-sync@2.29.3 → browser-sync@3.0.2 is a non-breaking change for this project

The vulnerability only affected Browsersync config tunnel: true which is not used by the Prototype Kit

joelanman commented 6 months ago

thanks this is good and we should do it, but just for clarity, we don't use that option so it's not currently a vulnerability that affects our users I dont think