search

gulp-community / gulp-livereload

gulp plugin for livereload
768 stars 67 forks source link

Low Severity Vulnerability in Debug #131

Closed timwright12 closed 6 years ago

timwright12 commented 6 years ago

Running npm audit on version 3.8.1 of gulp-livereload returns a low severity vulnerability with the debug dependency listed as version 2.1 /gulp-livereload/package.json

│ Low │ Regular Expression Denial of Service │ │ Package │ debug │ │ Patched in │ >= 2.6.9 < 3.0.0 || >= 3.1.0 │ │ Dependency of │ gulp-livereload [dev] │ │ Path │ gulp-livereload > mini-lr > body-parser > debug │ │ More info │ https://nodesecurity.io/advisories/534

It seems like updating debug to version 3.1 would fix this. I'm happy to submit this in a PR and test it out as it seems pretty small. Just wanted to document it as I don't have time at this moment.

timwright12 commented 6 years ago

Looks like this is also an issue with the mini-lr package

timwright12 commented 6 years ago

the PR https://github.com/vohof/gulp-livereload/pull/132 (I guess I did have time)