search

bower / bower

A package manager for the web
bower.io
MIT License
14.99k stars 1.85k forks source link

Currently uses a version of handlebars that contains a critical vulnerability #2595

Closed tyranhenry closed 2 years ago

tyranhenry commented 3 years ago

There is a failed pull request open here to update the version of handlebars from 4.5.3 to 4.7.7 and requires merging as currently the 4.5.3 version of handlebars contains a critical vulnerability; https://github.com/advisories/GHSA-f2jv-r9rf-7988

sheerun commented 2 years ago

This is purposeful as newer versions of request and configstore aren't compatilble with old node versions and Bower is in maintenance mode: we don't break backward compatibility. I determined that these vulnerabilities aren't important enough to subject new breaking-release. The preferred upgrade method for someone who really cares about security is to migrate to Yarn: https://bower.io/blog/2017/how-to-migrate-away-from-bower/