search

tatsuyafw / gulp-nightwatch

gulp plugin for Nightwatch.js
MIT License
30 stars 18 forks source link

Security issue: Upgrade nightwatch to 0.9.19 #45

Closed openjck closed 6 years ago

openjck commented 6 years ago

Nightwatch 0.9.16 uses ejs 0.8.3, which has two known security vulnerabilities:

https://nvd.nist.gov/vuln/detail/CVE-2017-1000188 (moderate severity) https://nvd.nist.gov/vuln/detail/CVE-2017-1000228 (high severity)

Nightwatch 0.9.19 uses a version of ejs without these problems.

openjck commented 6 years ago

Apologies. Your version range already covers 0.9.19. I got confused about how the ^ selector behaves with 0.x.x versions.