Update minimatch to improve security

lasso-js / lasso

Advanced JavaScript module bundler, asset pipeline and optimizer

581 stars 75 forks source link

Update minimatch to improve security #204

Open alexewerlof opened 7 years ago

alexewerlof commented 7 years ago

When installing lasso-cli the following warning shows up:

npm WARN deprecated minimatch@1.0.0: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue

austinkelleher commented 7 years ago

Yes you're right. It looks like lasso-cli is not using minimatch at all, and it can be safely removed. Additionally there are some sub-dependencies of Lasso that are out of date, which are also using out of date versions of minimatch. I will go ahead and get these updated. Thanks.