SSH2 lib has security vulnerabilities

[SteFletcher]

To resolve, please re-install dependencies and publish a new version of the package to bring in the latest fixed version of ssh2.

At the time of submission, the new version would be:

"ssh2": {
  "version": "1.5.0",
  "resolved": "https://registry.npmjs.org/ssh2/-/ssh2-1.5.0.tgz",
  "integrity": "sha512-iUmRkhH9KGeszQwDW7YyyqjsMTf4z+0o48Cp4xOwlY5LjtbIAvyd3fwnsoUZW/hXmTCRA3yt7S/Jb9uVjErVlA==",
  "requires": {
    "asn1": "^0.2.4",
    "bcrypt-pbkdf": "^1.0.2",
    "cpu-features": "0.0.2",
    "nan": "^2.15.0"
  }
},

[steelbrain]

@SteFletcher This package does not use a specific version for ssh2 but uses a semver range, meaning that your package manager should try to install the most up to date version that satisfies that range. The current latest version does specify the range so that would mean when people do npm install node-ssh, it already installs the fixed version.

I could, and I will push an update with the min version bumped, but then people will have to do the same thing they'd have to do anyway to get the latest ssh2 so not sure how it's making it better.

Thanks for reporting this issue and I hope you have a great day!