search

browserify / watchify

watch mode for browserify builds
Other
1.79k stars 203 forks source link

upgrade dependencies: security vulnerability in braces < 2.3.1, brfs < 2.0.1 #362

Closed velfundert closed 5 years ago

velfundert commented 5 years ago

Upgrade dependencies for watchify to mitigate security vulnerabilities detected by npm audit:

Upgrade https://github.com/micromatch/anymatch and https://github.com/paulmillr/chokidar to newest release versions, in order to fix a security vulnerability caused by https://github.com/micromatch/braces < 2.3.1: https://www.npmjs.com/advisories/786

Upgrade https://github.com/browserify/brfs to 2.0.1 to fix security vulnerability caused by https://github.com/browserify/static-eval: https://www.npmjs.com/advisories/758

ankurkaushal360 commented 5 years ago

I was just about to open a PR for this. Can we get this one merged please? Also, I think @velfundert you should bump minor version for the watchify itself.

Just my two cents. :)

goto-bus-stop commented 5 years ago

I'll try to merge it later today...please don't bump the version field, that'll be done in a separate commit to master :)

Fwiw, neither vulnerability actually applies to watchify, so don't worry about using it in the mean time